Public bug reported:
[Impact]
On systems with Intel DSA/IAA accelerators (the `idxd` driver), the **kdump
crash kernel
Oopses with a NULL-pointer dereference in `destroy_workqueue()`**. In the crash
kernel the
DSA/IAA devices are HALTED (inherited from the panicked kernel), so idxd probe
fails at
device reset before its workqueue is allocated, and
`idxd_conf_device_release()` then calls
`destroy_workqueue(NULL)`. The Oops — in a udev worker that exits with IRQs
disabled, on the
`nr_cpus=1` crash kernel — wedges the crash kernel: it can no longer finish the
vmcore or
reboot, so the host hangs and needs a manual BMC power reset. **Net effect:
kdump/vmcore
capture is broken on idxd-equipped hardware.**
Regressing commit (mainline): `3d33de353b1f ("dmaengine: idxd: Fix not
releasing workqueue
on .release()")`, which added an unconditional `destroy_workqueue(idxd->wq)` to
`idxd_conf_device_release()`.
Backtrace (full: `idxd-oops.txt`):
idxd 0000:6a:02.0: Intel(R) IDXD DMA Engine init failed
BUG: kernel NULL pointer dereference, address: 00000000000000b8
Oops: 0000 [#1] SMP NOPTI
CPU: 0 ... Comm: (udev-worker) ... 7.0.0-1010-nvidia
Hardware name: NVIDIA DGXH200/DGXH200, BIOS 1.7.8 12/05/2025
RIP: 0010:destroy_workqueue+0x17/0x390
RDI: 0000000000000000 CR2: 00000000000000b8
Call Trace:
idxd_conf_device_release+0x19/0xa0 [idxd]
put_device+0x13/0x30
idxd_pci_probe_alloc+0x285/0x460 [idxd]
idxd_pci_probe+0x16/0x30 [idxd]
...
idxd_init_module+0xd3/0xff0 [idxd]
note: (udev-worker)[1002] exited with irqs disabled
`RDI=0` / `CR2=0xb8` confirm `destroy_workqueue(NULL)`.
Reproducer:
On a system with `idxd` (Intel DSA/IAA) devices and kdump enabled:
echo 1 | sudo tee /proc/sys/kernel/sysrq
echo c | sudo tee /proc/sysrq-trigger
Without the fix: crash kernel Oopses in `destroy_workqueue()`, hangs, no reboot
(BMC reset
required). With the fix: no Oops, full vmcore saved, host reboots.
Affected kernels:
Any Ubuntu 7.0 `-generic` / `-nvidia` kernel carrying `3d33de353b1f` (observed
on
`linux-nvidia` 7.0, resolute/26.04; `-generic` has the same idxd code).
[Fix]
Two patches from Steve Wahl (HPE), on `[email protected]`, **Acked-by:
Vinicius
Costa Gomes** (author of the regression). **Not yet in mainline/linux-next as
of July 2026.**
1. **dmaengine: idxd: Do not call destroy_workqueue with null idxd->wq** —
`Fixes:
3d33de353b1f` —
https://lore.kernel.org/all/[email protected]/
(adds `if (idxd->wq) destroy_workqueue(idxd->wq);`)
2. **dmaengine: idxd: fix duplicate memory frees on initialization error path**
— patch 2/2
of the same series (removes a latent double-free on the
`idxd_alloc()`/`idxd_free()`
error unwind).
[Test Plan]
Compile and boot tested.
[Where problems could occur]
Low, confined to idxd probe/error paths: patch 1 only NULL-checks before
`destroy_workqueue()` (no change when the workqueue exists); patch 2 removes
double frees
already handled by the release callback. No effect on the normal (non-error)
path.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163062
Title:
idxd: crash-kernel NULL-pointer Oops in `destroy_workqueue()` breaks
kdump on Intel DSA/IAA systems
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2163062/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
