dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 108 insertions, 0 deletions

diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c
new file mode 100644
index 000000000..440fb7638
--- /dev/null
+++ b/rust/helpers/helpers.c
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Non-trivial C macros cannot be used in Rust. Similarly, inlined C functions
+ * cannot be called either. This file explicitly creates functions ("helpers")
+ * that wrap those so that they can be called from Rust.
+ *
+ * Sorted alphabetically.
+ */
+
+#include <linux/compiler_types.h>
+
+#ifdef __BINDGEN__
+// Omit `inline` for bindgen as it ignores inline functions.
+#define __rust_helper
+#else
+// The helper functions are all inline functions.
+//
+// We use `__always_inline` here to bypass LLVM inlining checks, in case the
+// helpers are inlined directly into Rust CGUs.
+//
+// The LLVM inlining checks are false positives:
+// * LLVM doesn't want to inline functions compiled with
+//   `-fno-delete-null-pointer-checks` with code compiled without.
+//   The C CGUs all have this enabled and Rust CGUs don't. Inlining is okay
+//   since this is one of the hardening features that does not change the ABI,
+//   and we shouldn't have null pointer dereferences in these helpers.
+// * LLVM doesn't want to inline functions with different list of builtins. C
+//   side has `-fno-builtin-wcslen`; `wcslen` is not a Rust builtin, so they
+//   should be compatible, but LLVM does not perform inlining due to attributes
+//   mismatch.
+// * clang and Rust doesn't have the exact target string. Clang generates
+//   `+cmov,+cx8,+fxsr` but Rust doesn't enable them (in fact, Rust will
+//   complain if `-Ctarget-feature=+cmov,+cx8,+fxsr` is used). x86-64 always
+//   enable these features, so they are in fact the same target string, but
+//   LLVM doesn't understand this and so inlining is inhibited. This can be
+//   bypassed with `--ignore-tti-inline-compatible`, but this is a hidden
+//   option.
+#define __rust_helper __always_inline
+#endif
+
+#include "atomic.c"
+#include "atomic_ext.c"
+#include "auxiliary.c"
+#include "barrier.c"
+#include "binder.c"
+#include "bitmap.c"
+#include "bitops.c"
+#include "blk.c"
+#include "bug.c"
+#include "build_assert.c"
+#include "build_bug.c"
+#include "clk.c"
+#include "completion.c"
+#include "cpu.c"
+#include "cpufreq.c"
+#include "cpumask.c"
+#include "cred.c"
+#include "device.c"
+#include "dma.c"
+#ifdef CONFIG_DMA_SHARED_BUFFER
+#include "dma-resv.c"
+#endif
+#include "drm.c"
+#include "drm_gpuvm.c"
+#include "err.c"
+#include "fs.c"
+#include "fwctl.c"
+#include "gpu.c"
+#include "interrupt.c"
+#include "io.c"
+#include "irq.c"
+#include "jump_label.c"
+#include "kunit.c"
+#include "list.c"
+#include "maple_tree.c"
+#include "mm.c"
+#include "mutex.c"
+#include "net/genetlink.c"
+#include "of.c"
+#include "page.c"
+#include "pci.c"
+#include "pid_namespace.c"
+#include "platform.c"
+#include "poll.c"
+#include "processor.c"
+#include "property.c"
+#include "pwm.c"
+#include "rbtree.c"
+#include "rcu.c"
+#include "refcount.c"
+#include "regulator.c"
+#include "scatterlist.c"
+#include "security.c"
+#include "serdev.c"
+#include "signal.c"
+#include "slab.c"
+#include "spinlock.c"
+#include "string.c"
+#include "srcu.c"
+#include "sync.c"
+#include "task.c"
+#include "time.c"
+#include "uaccess.c"
+#include "usb.c"
+#include "vmalloc.c"
+#include "wait.c"
+#include "workqueue.c"
+#include "xarray.c"