Patch "dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dmaengine-idxd-move-out-percpu_ref_exit-to-ensure-it.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4ceaf5b1da7e27b41c55ca041fd909c1c55c0402
Author: Dave Jiang <dave.jiang@xxxxxxxxx>
Date:   Wed Sep 29 12:15:38 2021 -0700

    dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission
    
    [ Upstream commit 85f604af9c83a4656b1d07bec73298c3ba7d7c1e ]
    
    percpu_ref_tryget_live() is safe to call as long as ref is between init and
    exit according to the function comment. Move percpu_ref_exit() so it is
    called after the dma channel is no longer valid to ensure this holds true.
    
    Fixes: 93a40a6d7428 ("dmaengine: idxd: add percpu_ref to descriptor submission path")
    Suggested-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    Signed-off-by: Dave Jiang <dave.jiang@xxxxxxxxx>
    Link: https://lore.kernel.org/r/163294293832.914350.10326422026738506152.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 83a5ff2ecf2a0..cbbfa17d8d11b 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -427,7 +427,6 @@ void idxd_wq_quiesce(struct idxd_wq *wq)
 {
 	percpu_ref_kill(&wq->wq_active);
 	wait_for_completion(&wq->wq_dead);
-	percpu_ref_exit(&wq->wq_active);
 }
 
 /* Device control bits */
diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
index e0f056c1d1f56..b90b085d18cff 100644
--- a/drivers/dma/idxd/dma.c
+++ b/drivers/dma/idxd/dma.c
@@ -311,6 +311,7 @@ static int idxd_dmaengine_drv_probe(struct idxd_dev *idxd_dev)
 
 err_dma:
 	idxd_wq_quiesce(wq);
+	percpu_ref_exit(&wq->wq_active);
 err_ref:
 	idxd_wq_free_resources(wq);
 err_res_alloc:
@@ -329,6 +330,7 @@ static void idxd_dmaengine_drv_remove(struct idxd_dev *idxd_dev)
 	idxd_wq_quiesce(wq);
 	idxd_unregister_dma_channel(wq);
 	__drv_disable_wq(wq);
+	percpu_ref_exit(&wq->wq_active);
 	idxd_wq_free_resources(wq);
 	wq->type = IDXD_WQT_NONE;
 	mutex_unlock(&wq->wq_lock);