Re: [PATCH] dmaengine: idxd: Free the minor number when cdev setup fails

[Frank Li]

On Thu, Sep 10, 2026 at 04:48:32PM +0900, SeungUk Nam wrote:
> idxd_wq_add_cdev() allocates a minor number from cdev_ctx->minor_ida for
> the new struct idxd_cdev. When dev_set_name() or cdev_device_add()
> fails, the error path calls put_device(), and the release callback
> idxd_cdev_dev_release() only frees idxd_cdev, so the minor number is
> never returned to the ida. Leaked numbers accumulate across bind/unbind
> cycles, up to MINORMASK, for as long as the module stays loaded.
>
> Free the minor number before put_device() drops the last reference on
> that path.
>
> Fixes: c311f5e92484 ("dmaengine: idxd: Fix freeing the allocated ida too late")
> Signed-off-by: SeungUk Nam <tmddnr49449@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>
> Found by code inspection; the error path was not exercised at runtime.
>
>  drivers/dma/idxd/cdev.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index 82b07cf942ef..f1af7f0d25d3 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -573,6 +573,7 @@ int idxd_wq_add_cdev(struct idxd_wq *wq)
>  	return 0;
>
>   err:
> +	ida_free(&cdev_ctx->minor_ida, minor);
>  	put_device(dev);
>  	wq->idxd_cdev = NULL;
>  	return rc;
> --
> 2.34.1
>