dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 86 insertions, 0 deletions

diff --git a/drivers/net/arcnet/Kconfig b/drivers/net/arcnet/Kconfig
new file mode 100644
index 000000000..4611a3716
--- /dev/null
+++ b/drivers/net/arcnet/Kconfig
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Arcnet configuration
+#
+
+menuconfig ARCNET
+	depends on NETDEVICES && PCI && HAS_IOPORT
+	tristate "ARCnet support"
+	help
+	  If you have a network card of this type, say Y and check out the
+	  (arguably) beautiful poetry in
+	  <file:Documentation/networking/arcnet.rst>.
+
+	  You need both this driver, and the driver for the particular ARCnet
+	  chipset of your card.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called arcnet.
+
+if ARCNET
+
+config ARCNET_1201
+	tristate "Enable standard ARCNet packet format (RFC 1201)"
+	help
+	  This allows you to use RFC1201 with your ARCnet card via the virtual
+	  arc0 device.  You need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers.  Please read the
+	  ARCnet documentation in <file:Documentation/networking/arcnet.rst>
+	  for more information about using arc0.
+
+config ARCNET_1051
+	tristate "Enable old ARCNet packet format (RFC 1051)"
+	help
+	  This allows you to use RFC1051 with your ARCnet card via the virtual
+	  arc0s device. You only need arc0s if you want to talk to ARCnet
+	  software complying with the "old" standard, specifically, the DOS
+	  arcnet.com packet driver, Amigas running AmiTCP, and some variants
+	  of NetBSD. You do not need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers. RFC1201 is included
+	  automatically as the arc0 device. Please read the ARCnet
+	  documentation in <file:Documentation/networking/arcnet.rst> for more
+	  information about using arc0e and arc0s.
+
+config ARCNET_RAW
+	tristate "Enable raw mode packet interface"
+	help
+	  ARCnet "raw mode" packet encapsulation, no soft headers.  Unlikely
+	  to work unless talking to a copy of the same Linux arcnet driver,
+	  but perhaps marginally faster in that case.
+
+config ARCNET_CAP
+	tristate "Enable CAP mode packet interface"
+	help
+	  ARCnet "cap mode" packet encapsulation. Used to get the hardware
+	  acknowledge back to userspace. After the initial protocol byte every
+	  packet is stuffed with an extra 4 byte "cookie" which doesn't
+	  actually appear on the network. After transmit the driver will send
+	  back a packet with protocol byte 0 containing the status of the
+	  transmission:
+	     0=no hardware acknowledge
+	     1=excessive nak
+	     2=transmission accepted by the receiver hardware
+
+	  Received packets are also stuffed with the extra 4 bytes but it will
+	  be random data.
+
+	  Cap only listens to protocol 1-8.
+
+config ARCNET_COM20020
+	tristate "ARCnet COM20020 chipset driver"
+	depends on LEDS_CLASS
+	help
+	  This is the driver for the new COM20020 chipset. It supports such
+	  things as promiscuous mode, so packet sniffing is possible, and
+	  extra diagnostic information.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called com20020.
+
+config ARCNET_COM20020_PCI
+	tristate "Support for COM20020 on PCI"
+	depends on ARCNET_COM20020 && PCI
+
+endif # ARCNET