From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- crypto/tcrypt.h | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 crypto/tcrypt.h (limited to 'crypto/tcrypt.h') diff --git a/crypto/tcrypt.h b/crypto/tcrypt.h new file mode 100644 index 000000000..85c3f77bc --- /dev/null +++ b/crypto/tcrypt.h @@ -0,0 +1,99 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Quick & dirty crypto benchmarking module. + * + * This will only exist until we have a better benchmarking mechanism + * (e.g. a char device). + * + * Copyright (c) 2002 James Morris + * Copyright (c) 2002 Jean-Francois Dive + * Copyright (c) 2007 Nokia Siemens Networks + */ +#ifndef _CRYPTO_TCRYPT_H +#define _CRYPTO_TCRYPT_H + +struct cipher_speed_template { + const char *key; + unsigned int klen; +}; + +struct aead_speed_template { + const char *key; + unsigned int klen; +}; + +struct hash_speed { + unsigned int blen; /* buffer length */ + unsigned int plen; /* per-update length */ +}; + +/* + * DES test vectors. + */ +#define DES3_SPEED_VECTORS 1 + +static struct cipher_speed_template des3_speed_template[] = { + { + .key = "\x01\x23\x45\x67\x89\xab\xcd\xef" + "\x55\x55\x55\x55\x55\x55\x55\x55" + "\xfe\xdc\xba\x98\x76\x54\x32\x10", + .klen = 24, + } +}; + +/* + * Cipher speed tests + */ +static u8 speed_template_8[] = {8, 0}; +static u8 speed_template_16[] = {16, 0}; +static u8 speed_template_24[] = {24, 0}; +static u8 speed_template_8_16[] = {8, 16, 0}; +static u8 speed_template_8_32[] = {8, 32, 0}; +static u8 speed_template_16_32[] = {16, 32, 0}; +static u8 speed_template_16_24_32[] = {16, 24, 32, 0}; +static u8 speed_template_20_28_36[] = {20, 28, 36, 0}; +static u8 speed_template_32_40_48[] = {32, 40, 48, 0}; +static u8 speed_template_32_48[] = {32, 48, 0}; +static u8 speed_template_32_48_64[] = {32, 48, 64, 0}; +static u8 speed_template_32_64[] = {32, 64, 0}; +static u8 speed_template_32[] = {32, 0}; + +/* + * AEAD speed tests + */ +static u8 aead_speed_template_19[] = {19, 0}; +static u8 aead_speed_template_20_28_36[] = {20, 28, 36, 0}; +static u8 aead_speed_template_36[] = {36, 0}; + +/* + * Digest speed tests + */ +static struct hash_speed generic_hash_speed_template[] = { + { .blen = 16, .plen = 16, }, + { .blen = 64, .plen = 16, }, + { .blen = 64, .plen = 64, }, + { .blen = 256, .plen = 16, }, + { .blen = 256, .plen = 64, }, + { .blen = 256, .plen = 256, }, + { .blen = 1024, .plen = 16, }, + { .blen = 1024, .plen = 256, }, + { .blen = 1024, .plen = 1024, }, + { .blen = 2048, .plen = 16, }, + { .blen = 2048, .plen = 256, }, + { .blen = 2048, .plen = 1024, }, + { .blen = 2048, .plen = 2048, }, + { .blen = 4096, .plen = 16, }, + { .blen = 4096, .plen = 256, }, + { .blen = 4096, .plen = 1024, }, + { .blen = 4096, .plen = 4096, }, + { .blen = 8192, .plen = 16, }, + { .blen = 8192, .plen = 256, }, + { .blen = 8192, .plen = 1024, }, + { .blen = 8192, .plen = 4096, }, + { .blen = 8192, .plen = 8192, }, + + /* End marker */ + { .blen = 0, .plen = 0, } +}; + +#endif /* _CRYPTO_TCRYPT_H */ -- cgit v1.3.1