dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 152 insertions, 0 deletions

diff --git a/Documentation/driver-api/index.rst b/Documentation/driver-api/index.rst
new file mode 100644
index 000000000..6601a2586
--- /dev/null
+++ b/Documentation/driver-api/index.rst
@@ -0,0 +1,152 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==============================
+Driver implementer's API guide
+==============================
+
+The kernel offers a wide variety of interfaces to support the development
+of device drivers.  This document is an only somewhat organized collection
+of some of those interfaces — it will hopefully get better over time!  The
+available subsections can be seen below.
+
+
+General information for driver authors
+======================================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   basics
+   driver-model/index
+   device_link
+   infrastructure
+   ioctl
+   pm/index
+
+Useful support libraries
+========================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   early-userspace/index
+   connector
+   device-io
+   devfreq
+   dma-buf
+   component
+   io-mapping
+   io_ordering
+   uio-howto
+   vfio-mediated-device
+   vfio
+   vfio-pci-device-specific-driver-acceptance
+
+Bus-level documentation
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   auxiliary_bus
+   cxl/index
+   eisa
+   firewire
+   i3c/index
+   isa
+   men-chameleon-bus
+   pci/index
+   rapidio/index
+   slimbus
+   usb/index
+   virtio/index
+   vme
+   w1
+   xillybus
+
+
+Subsystem-specific APIs
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   80211/index
+   acpi/index
+   backlight/lp855x-driver.rst
+   clk
+   coco/index
+   console
+   crypto/index
+   dmaengine/index
+   dpll
+   edac
+   extcon
+   firmware/index
+   fpga/index
+   frame-buffer
+   aperture
+   generic-counter
+   generic_pt
+   gpio/index
+   hsi
+   hte/index
+   hw-recoverable-errors
+   i2c
+   iio/index
+   infiniband
+   input
+   interconnect
+   ipmb
+   ipmi
+   issei/index
+   libata
+   mailbox
+   md/index
+   media/index
+   mei/index
+   memory-devices/index
+   message-based
+   misc_devices
+   miscellaneous
+   mmc/index
+   mtd/index
+   mtdnand
+   nfc/index
+   ntb
+   nvdimm/index
+   nvmem
+   parport-lowlevel
+   phy/index
+   pin-control
+   pldmfw/index
+   pps
+   ptp
+   pwm
+   pwrseq
+   regulator
+   reset
+   rfkill
+   s390-drivers
+   scsi
+   serial/index
+   sm501
+   soundwire/index
+   spi
+   surface_aggregator/index
+   switchtec
+   sync_file
+   target
+   tee
+   thermal/index
+   tty/index
+   wbrf
+   wmi
+   xilinx/index
+   zorro