dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()grafted

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

1 files changed, 115 insertions, 0 deletions

diff --git a/tools/include/nolibc/Makefile b/tools/include/nolibc/Makefile
new file mode 100644
index 000000000..6d213d372
--- /dev/null
+++ b/tools/include/nolibc/Makefile
@@ -0,0 +1,115 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for nolibc installation and tests
+include ../../scripts/Makefile.include
+
+# we're in ".../tools/include/nolibc"
+ifeq ($(srctree),)
+srctree := $(patsubst %/tools/include/,%,$(dir $(CURDIR)))
+endif
+
+# when run as make -C tools/ nolibc_<foo> the arch is not set
+ifeq ($(ARCH),)
+include $(srctree)/scripts/subarch.include
+ARCH = $(SUBARCH)
+endif
+
+# OUTPUT is only set when run from the main makefile, otherwise
+# it defaults to this nolibc directory.
+OUTPUT ?= $(CURDIR)/
+
+architectures := alpha arm arm64 loongarch m68k mips openrisc parisc powerpc riscv s390 sh sparc x86
+arch_files := arch.h $(addsuffix .h, $(addprefix arch-, $(architectures)))
+all_files := \
+		alloca.h \
+		assert.h \
+		byteswap.h \
+		compiler.h \
+		crt.h \
+		ctype.h \
+		dirent.h \
+		elf.h \
+		endian.h \
+		err.h \
+		errno.h \
+		fcntl.h \
+		getopt.h \
+		inttypes.h \
+		limits.h \
+		math.h \
+		nolibc.h \
+		poll.h \
+		sched.h \
+		signal.h \
+		stackprotector.h \
+		std.h \
+		stdarg.h \
+		stdbool.h \
+		stddef.h \
+		stdint.h \
+		stdlib.h \
+		string.h \
+		sys.h \
+		sys/auxv.h \
+		sys/ioctl.h \
+		sys/mman.h \
+		sys/mount.h \
+		sys/prctl.h \
+		sys/ptrace.h \
+		sys/random.h \
+		sys/reboot.h \
+		sys/resource.h \
+		sys/select.h \
+		sys/stat.h \
+		sys/syscall.h \
+		sys/sysmacros.h \
+		sys/time.h \
+		sys/timerfd.h \
+		sys/types.h \
+		sys/uio.h \
+		sys/utsname.h \
+		sys/wait.h \
+		time.h \
+		types.h \
+		unistd.h \
+		stdio.h \
+
+
+# install all headers needed to support a bare-metal compiler
+all: headers
+
+install: help
+
+help:
+	@echo "Supported targets under nolibc:"
+	@echo "  all                 call \"headers\""
+	@echo "  clean               clean the sysroot"
+	@echo "  headers             prepare a multi-arch sysroot in \$${OUTPUT}sysroot"
+	@echo "  headers_standalone  like \"headers\", and also install kernel headers"
+	@echo "  help                this help"
+	@echo ""
+	@echo "These targets may also be called from tools as \"make nolibc_<target>\"."
+	@echo ""
+	@echo "Currently using the following variables:"
+	@echo "  ARCH    = $(ARCH)"
+	@echo "  OUTPUT  = $(OUTPUT)"
+	@echo ""
+
+# installs headers for all archs at once.
+headers:
+	$(Q)mkdir -p "$(OUTPUT)sysroot/include"
+	$(Q)cp --parents $(arch_files) $(all_files) "$(OUTPUT)sysroot/include/"
+
+headers_standalone: headers
+	$(Q)$(MAKE) -C $(srctree) headers_install INSTALL_HDR_PATH=$(OUTPUT)sysroot
+
+CFLAGS_s390 := -m64
+CFLAGS := $(CFLAGS_$(ARCH))
+
+headers_check: headers_standalone
+	$(Q)for header in $(filter-out crt.h std.h,$(all_files)); do \
+		$(CC) $(CFLAGS) $(CLANG_CROSS_FLAGS) -Wall -Werror -nostdinc -fsyntax-only -x c /dev/null \
+			-I$(or $(objtree),$(srctree))/usr/include -include $$header -include $$header || exit 1; \
+	done
+
+clean:
+	$(call QUIET_CLEAN, nolibc) rm -rf "$(OUTPUT)sysroot"