dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission

[ Upstream commit 85f604af9c83a4656b1d07bec73298c3ba7d7c1e ]

percpu_ref_tryget_live() is safe to call as long as ref is between init and
exit according to the function comment. Move percpu_ref_exit() so it is
called after the dma channel is no longer valid to ensure this holds true.

Fixes: 93a40a6d7428 ("dmaengine: idxd: add percpu_ref to descriptor submission path")
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/163294293832.914350.10326422026738506152.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 83a5ff2ecf2a0fcab3a8d148f0b7bf046cbcac1f..cbbfa17d8d11bf9c8d0e5a8961177d906ab26b83 100644 (file)
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -427,7 +427,6 @@ void idxd_wq_quiesce(struct idxd_wq *wq)
 {
        percpu_ref_kill(&wq->wq_active);
        wait_for_completion(&wq->wq_dead);
-       percpu_ref_exit(&wq->wq_active);
 }
 
 /* Device control bits */

diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
index e0f056c1d1f565d09f0bb2e6b9d6a8e058dcb9c9..b90b085d18cffe38e1df61069bebe33e2fa2570b 100644 (file)
--- a/drivers/dma/idxd/dma.c
+++ b/drivers/dma/idxd/dma.c
@@ -311,6 +311,7 @@ static int idxd_dmaengine_drv_probe(struct idxd_dev *idxd_dev)
 
 err_dma:
        idxd_wq_quiesce(wq);
+       percpu_ref_exit(&wq->wq_active);
 err_ref:
        idxd_wq_free_resources(wq);
 err_res_alloc:
@@ -329,6 +330,7 @@ static void idxd_dmaengine_drv_remove(struct idxd_dev *idxd_dev)
        idxd_wq_quiesce(wq);
        idxd_unregister_dma_channel(wq);
        __drv_disable_wq(wq);
+       percpu_ref_exit(&wq->wq_active);
        idxd_wq_free_resources(wq);
        wq->type = IDXD_WQT_NONE;
        mutex_unlock(&wq->wq_lock);