From: Vinicius Costa Gomes <vinicius.gomes@intel.com> mainline inclusion from mainline-v7.0-rc6 commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14596 CVE: CVE-2026-43064 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- The workqueue associated with an DSA/IAA device is not released when the object is freed. Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime") Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed7... Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Yin Tirui <yintirui@huawei.com> --- drivers/dma/idxd/sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c index f900976acf7e..c9e4d37a189f 100644 --- a/drivers/dma/idxd/sysfs.c +++ b/drivers/dma/idxd/sysfs.c @@ -1663,6 +1663,7 @@ static void idxd_conf_device_release(struct device *dev) { struct idxd_device *idxd = confdev_to_idxd(dev); + destroy_workqueue(idxd->wq); kfree(idxd->groups); bitmap_free(idxd->wq_enable_map); kfree(idxd->wqs); -- 2.43.0