From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- arch/powerpc/boot/simpleboot.c | 87 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 arch/powerpc/boot/simpleboot.c (limited to 'arch/powerpc/boot/simpleboot.c') diff --git a/arch/powerpc/boot/simpleboot.c b/arch/powerpc/boot/simpleboot.c new file mode 100644 index 000000000..27591df41 --- /dev/null +++ b/arch/powerpc/boot/simpleboot.c @@ -0,0 +1,87 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * The simple platform -- for booting when firmware doesn't supply a device + * tree or any platform configuration information. + * All data is extracted from an embedded device tree + * blob. + * + * Authors: Scott Wood + * Grant Likely + * + * Copyright (c) 2007 Freescale Semiconductor, Inc. + * Copyright (c) 2008 Secret Lab Technologies Ltd. + */ + +#include "ops.h" +#include "types.h" +#include "io.h" +#include "stdio.h" +#include + +BSS_STACK(4*1024); + +extern int platform_specific_init(void) __attribute__((weak)); + +void platform_init(unsigned long r3, unsigned long r4, unsigned long r5, + unsigned long r6, unsigned long r7) +{ + const u32 *na, *ns, *reg, *timebase; + u64 memsize64; + int node, size, i; + + /* Make sure FDT blob is sane */ + if (fdt_check_header(_dtb_start) != 0) + fatal("Invalid device tree blob\n"); + + /* Find the #address-cells and #size-cells properties */ + node = fdt_path_offset(_dtb_start, "/"); + if (node < 0) + fatal("Cannot find root node\n"); + na = fdt_getprop(_dtb_start, node, "#address-cells", &size); + if (!na || (size != 4)) + fatal("Cannot find #address-cells property"); + ns = fdt_getprop(_dtb_start, node, "#size-cells", &size); + if (!ns || (size != 4)) + fatal("Cannot find #size-cells property"); + + /* Find the memory range */ + node = fdt_node_offset_by_prop_value(_dtb_start, -1, "device_type", + "memory", sizeof("memory")); + if (node < 0) + fatal("Cannot find memory node\n"); + reg = fdt_getprop(_dtb_start, node, "reg", &size); + if (size < (*na+*ns) * sizeof(u32)) + fatal("cannot get memory range\n"); + + /* Only interested in memory based at 0 */ + for (i = 0; i < *na; i++) + if (*reg++ != 0) + fatal("Memory range is not based at address 0\n"); + + /* get the memsize and truncate it to under 4G on 32 bit machines */ + memsize64 = 0; + for (i = 0; i < *ns; i++) + memsize64 = (memsize64 << 32) | *reg++; + if (sizeof(void *) == 4 && memsize64 >= 0x100000000ULL) + memsize64 = 0xffffffff; + + /* finally, setup the timebase */ + node = fdt_node_offset_by_prop_value(_dtb_start, -1, "device_type", + "cpu", sizeof("cpu")); + if (node < 0) + fatal("Cannot find cpu node\n"); + timebase = fdt_getprop(_dtb_start, node, "timebase-frequency", &size); + if (timebase && (size == 4)) + timebase_period_ns = 1000000000 / *timebase; + + /* Now we have the memory size; initialize the heap */ + simple_alloc_init(_end, memsize64 - (unsigned long)_end, 32, 64); + + /* prepare the device tree and find the console */ + fdt_init(_dtb_start); + + if (platform_specific_init) + platform_specific_init(); + + serial_console_init(); +} -- cgit v1.3.1