[Bug 2163062] Re: idxd: crash-kernel NULL-pointer Oops in `destroy_workqueue()` breaks kdump on Intel DSA/IAA systems

Patch submitted to KTML: [SRU][R][PATCH 0/2] dmaengine: idxd: fix kdump crash kernel NULL deref / double-free in idxd release path -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2163062 Title: idxd: crash-kernel NULL-pointer Oops in `destroy_workqueue()` breaks kdump on Intel DSA/IAA systems Status in linux package in Ubuntu: New Status in linux source package in Resolute: New Bug description: [Impact] On systems with Intel DSA/IAA accelerators (the `idxd` driver), the **kdump crash kernel Oopses with a NULL-pointer dereference in `destroy_workqueue()`**. In the crash kernel the DSA/IAA devices are HALTED (inherited from the panicked kernel), so idxd probe fails at device reset before its workqueue is allocated, and `idxd_conf_device_release()` then calls `destroy_workqueue(NULL)`. The Oops — in a udev worker that exits with IRQs disabled, on the `nr_cpus=1` crash kernel — wedges the crash kernel: it can no longer finish the vmcore or reboot, so the host hangs and needs a manual BMC power reset. **Net effect: kdump/vmcore capture is broken on idxd-equipped hardware.** Regressing commit (mainline): `3d33de353b1f ("dmaengine: idxd: Fix not releasing workqueue on .release()")`, which added an unconditional `destroy_workqueue(idxd->wq)` to `idxd_conf_device_release()`. Backtrace (full: `idxd-oops.txt`): idxd 0000:6a:02.0: Intel(R) IDXD DMA Engine init failed BUG: kernel NULL pointer dereference, address: 00000000000000b8 Oops: 0000 [#1] SMP NOPTI CPU: 0 ... Comm: (udev-worker) ... 7.0.0-1010-nvidia Hardware name: NVIDIA DGXH200/DGXH200, BIOS 1.7.8 12/05/2025 RIP: 0010:destroy_workqueue+0x17/0x390 RDI: 0000000000000000 CR2: 00000000000000b8 Call Trace: idxd_conf_device_release+0x19/0xa0 [idxd] put_device+0x13/0x30 idxd_pci_probe_alloc+0x285/0x460 [idxd] idxd_pci_probe+0x16/0x30 [idxd] ... idxd_init_module+0xd3/0xff0 [idxd] note: (udev-worker)[1002] exited with irqs disabled `RDI=0` / `CR2=0xb8` confirm `destroy_workqueue(NULL)`. Reproducer: On a system with `idxd` (Intel DSA/IAA) devices and kdump enabled: echo 1 | sudo tee /proc/sys/kernel/sysrq echo c | sudo tee /proc/sysrq-trigger Without the fix: crash kernel Oopses in `destroy_workqueue()`, hangs, no reboot (BMC reset required). With the fix: no Oops, full vmcore saved, host reboots. Affected kernels: Any Ubuntu 7.0 `-generic` / `-nvidia` kernel carrying `3d33de353b1f` (observed on `linux-nvidia` 7.0, resolute/26.04; `-generic` has the same idxd code). [Fix] Two patches from Steve Wahl (HPE), on `dmaengine@vger.kernel.org`, **Acked-by: Vinicius Costa Gomes** (author of the regression). **Not yet in mainline/linux-next as of July 2026.** 1. **dmaengine: idxd: Do not call destroy_workqueue with null idxd->wq** — `Fixes: 3d33de353b1f` — https://lore.kernel.org/all/20260522203414.336549-1-steve.wahl@hpe.com/ (adds `if (idxd->wq) destroy_workqueue(idxd->wq);`) 2. **dmaengine: idxd: fix duplicate memory frees on initialization error path** — patch 2/2 of the same series (removes a latent double-free on the `idxd_alloc()`/`idxd_free()` error unwind). [Test Plan] Compile and boot tested. [Where problems could occur] Low, confined to idxd probe/error paths: patch 1 only NULL-checks before `destroy_workqueue()` (no change when the workqueue exists); patch 2 removes double frees already handled by the release callback. No effect on the normal (non-error) path. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2163062/+subscriptions