dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 184 insertions, 0 deletions

diff --git a/rust/syn/macros.rs b/rust/syn/macros.rs
new file mode 100644
index 000000000..8676f6492
--- /dev/null
+++ b/rust/syn/macros.rs
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+#[cfg_attr(
+    not(any(feature = "full", feature = "derive")),
+    allow(unknown_lints, unused_macro_rules)
+)]
+macro_rules! ast_struct {
+    (
+        $(#[$attr:meta])*
+        $pub:ident $struct:ident $name:ident #full $body:tt
+    ) => {
+        check_keyword_matches!(pub $pub);
+        check_keyword_matches!(struct $struct);
+
+        #[cfg(feature = "full")]
+        $(#[$attr])* $pub $struct $name $body
+
+        #[cfg(not(feature = "full"))]
+        $(#[$attr])* $pub $struct $name {
+            _noconstruct: ::std::marker::PhantomData<::proc_macro2::Span>,
+        }
+
+        #[cfg(all(not(feature = "full"), feature = "printing"))]
+        impl ::quote::ToTokens for $name {
+            fn to_tokens(&self, _: &mut ::proc_macro2::TokenStream) {
+                unreachable!()
+            }
+        }
+    };
+
+    (
+        $(#[$attr:meta])*
+        $pub:ident $struct:ident $name:ident $body:tt
+    ) => {
+        check_keyword_matches!(pub $pub);
+        check_keyword_matches!(struct $struct);
+
+        $(#[$attr])* $pub $struct $name $body
+    };
+}
+
+#[cfg(any(feature = "full", feature = "derive"))]
+macro_rules! ast_enum {
+    (
+        $(#[$enum_attr:meta])*
+        $pub:ident $enum:ident $name:ident $body:tt
+    ) => {
+        check_keyword_matches!(pub $pub);
+        check_keyword_matches!(enum $enum);
+
+        $(#[$enum_attr])* $pub $enum $name $body
+    };
+}
+
+macro_rules! ast_enum_of_structs {
+    (
+        $(#[$enum_attr:meta])*
+        $pub:ident $enum:ident $name:ident $body:tt
+    ) => {
+        check_keyword_matches!(pub $pub);
+        check_keyword_matches!(enum $enum);
+
+        $(#[$enum_attr])* $pub $enum $name $body
+
+        ast_enum_of_structs_impl!($name $body);
+
+        #[cfg(feature = "printing")]
+        generate_to_tokens!(() tokens $name $body);
+    };
+}
+
+macro_rules! ast_enum_of_structs_impl {
+    (
+        $name:ident {
+            $(
+                $(#[cfg $cfg_attr:tt])*
+                $(#[doc $($doc_attr:tt)*])*
+                $variant:ident $( ($member:ident) )*,
+            )*
+        }
+    ) => {
+        $($(
+            ast_enum_from_struct!($name::$variant, $member);
+        )*)*
+    };
+}
+
+macro_rules! ast_enum_from_struct {
+    // No From<TokenStream> for verbatim variants.
+    ($name:ident::Verbatim, $member:ident) => {};
+
+    ($name:ident::$variant:ident, $member:ident) => {
+        impl From<$member> for $name {
+            fn from(e: $member) -> $name {
+                $name::$variant(e)
+            }
+        }
+    };
+}
+
+#[cfg(feature = "printing")]
+macro_rules! generate_to_tokens {
+    (
+        ($($arms:tt)*) $tokens:ident $name:ident {
+            $(#[cfg $cfg_attr:tt])*
+            $(#[doc $($doc_attr:tt)*])*
+            $variant:ident,
+            $($next:tt)*
+        }
+    ) => {
+        generate_to_tokens!(
+            ($($arms)* $(#[cfg $cfg_attr])* $name::$variant => {})
+            $tokens $name { $($next)* }
+        );
+    };
+
+    (
+        ($($arms:tt)*) $tokens:ident $name:ident {
+            $(#[cfg $cfg_attr:tt])*
+            $(#[doc $($doc_attr:tt)*])*
+            $variant:ident($member:ident),
+            $($next:tt)*
+        }
+    ) => {
+        generate_to_tokens!(
+            ($($arms)* $(#[cfg $cfg_attr])* $name::$variant(_e) => _e.to_tokens($tokens),)
+            $tokens $name { $($next)* }
+        );
+    };
+
+    (($($arms:tt)*) $tokens:ident $name:ident {}) => {
+        #[cfg_attr(docsrs, doc(cfg(feature = "printing")))]
+        impl ::quote::ToTokens for $name {
+            fn to_tokens(&self, $tokens: &mut ::proc_macro2::TokenStream) {
+                match self {
+                    $($arms)*
+                }
+            }
+        }
+    };
+}
+
+// Rustdoc bug: does not respect the doc(hidden) on some items.
+#[cfg(all(doc, feature = "parsing"))]
+macro_rules! pub_if_not_doc {
+    ($(#[$m:meta])* $pub:ident $($item:tt)*) => {
+        check_keyword_matches!(pub $pub);
+
+        $(#[$m])*
+        $pub(crate) $($item)*
+    };
+}
+
+#[cfg(all(not(doc), feature = "parsing"))]
+macro_rules! pub_if_not_doc {
+    ($(#[$m:meta])* $pub:ident $($item:tt)*) => {
+        check_keyword_matches!(pub $pub);
+
+        $(#[$m])*
+        $pub $($item)*
+    };
+}
+
+macro_rules! check_keyword_matches {
+    (enum enum) => {};
+    (pub pub) => {};
+    (struct struct) => {};
+}
+
+#[cfg(any(feature = "full", feature = "derive"))]
+macro_rules! return_impl_trait {
+    (
+        $(#[$attr:meta])*
+        $vis:vis fn $name:ident $args:tt -> $impl_trait:ty [$concrete:ty] $body:block
+    ) => {
+        #[cfg(not(docsrs))]
+        $(#[$attr])*
+        $vis fn $name $args -> $concrete $body
+
+        #[cfg(docsrs)]
+        $(#[$attr])*
+        $vis fn $name $args -> $impl_trait $body
+    };
+}