dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 109 insertions, 0 deletions

diff --git a/rust/syn/tt.rs b/rust/syn/tt.rs
new file mode 100644
index 000000000..fc7adec3d
--- /dev/null
+++ b/rust/syn/tt.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+use proc_macro2::{Delimiter, TokenStream, TokenTree};
+use std::hash::{Hash, Hasher};
+
+pub(crate) struct TokenTreeHelper<'a>(pub &'a TokenTree);
+
+impl<'a> PartialEq for TokenTreeHelper<'a> {
+    fn eq(&self, other: &Self) -> bool {
+        use proc_macro2::Spacing;
+
+        match (self.0, other.0) {
+            (TokenTree::Group(g1), TokenTree::Group(g2)) => {
+                match (g1.delimiter(), g2.delimiter()) {
+                    (Delimiter::Parenthesis, Delimiter::Parenthesis)
+                    | (Delimiter::Brace, Delimiter::Brace)
+                    | (Delimiter::Bracket, Delimiter::Bracket)
+                    | (Delimiter::None, Delimiter::None) => {}
+                    _ => return false,
+                }
+
+                let s1 = g1.stream().into_iter();
+                let mut s2 = g2.stream().into_iter();
+
+                for item1 in s1 {
+                    let item2 = match s2.next() {
+                        Some(item) => item,
+                        None => return false,
+                    };
+                    if TokenTreeHelper(&item1) != TokenTreeHelper(&item2) {
+                        return false;
+                    }
+                }
+                s2.next().is_none()
+            }
+            (TokenTree::Punct(o1), TokenTree::Punct(o2)) => {
+                o1.as_char() == o2.as_char()
+                    && match (o1.spacing(), o2.spacing()) {
+                        (Spacing::Alone, Spacing::Alone) | (Spacing::Joint, Spacing::Joint) => true,
+                        _ => false,
+                    }
+            }
+            (TokenTree::Literal(l1), TokenTree::Literal(l2)) => l1.to_string() == l2.to_string(),
+            (TokenTree::Ident(s1), TokenTree::Ident(s2)) => s1 == s2,
+            _ => false,
+        }
+    }
+}
+
+impl<'a> Hash for TokenTreeHelper<'a> {
+    fn hash<H: Hasher>(&self, h: &mut H) {
+        use proc_macro2::Spacing;
+
+        match self.0 {
+            TokenTree::Group(g) => {
+                0u8.hash(h);
+                match g.delimiter() {
+                    Delimiter::Parenthesis => 0u8.hash(h),
+                    Delimiter::Brace => 1u8.hash(h),
+                    Delimiter::Bracket => 2u8.hash(h),
+                    Delimiter::None => 3u8.hash(h),
+                }
+
+                for item in g.stream() {
+                    TokenTreeHelper(&item).hash(h);
+                }
+                0xFFu8.hash(h); // terminator w/ a variant we don't normally hash
+            }
+            TokenTree::Punct(op) => {
+                1u8.hash(h);
+                op.as_char().hash(h);
+                match op.spacing() {
+                    Spacing::Alone => 0u8.hash(h),
+                    Spacing::Joint => 1u8.hash(h),
+                }
+            }
+            TokenTree::Literal(lit) => (2u8, lit.to_string()).hash(h),
+            TokenTree::Ident(word) => (3u8, word).hash(h),
+        }
+    }
+}
+
+pub(crate) struct TokenStreamHelper<'a>(pub &'a TokenStream);
+
+impl<'a> PartialEq for TokenStreamHelper<'a> {
+    fn eq(&self, other: &Self) -> bool {
+        let left = self.0.clone().into_iter().collect::<Vec<_>>();
+        let right = other.0.clone().into_iter().collect::<Vec<_>>();
+        if left.len() != right.len() {
+            return false;
+        }
+        for (a, b) in left.into_iter().zip(right) {
+            if TokenTreeHelper(&a) != TokenTreeHelper(&b) {
+                return false;
+            }
+        }
+        true
+    }
+}
+
+impl<'a> Hash for TokenStreamHelper<'a> {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        let tts = self.0.clone().into_iter().collect::<Vec<_>>();
+        tts.len().hash(state);
+        for tt in tts {
+            TokenTreeHelper(&tt).hash(state);
+        }
+    }
+}