From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- drivers/input/apm-power.c | 122 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 122 insertions(+) create mode 100644 drivers/input/apm-power.c (limited to 'drivers/input/apm-power.c') diff --git a/drivers/input/apm-power.c b/drivers/input/apm-power.c new file mode 100644 index 000000000..028fcaf4c --- /dev/null +++ b/drivers/input/apm-power.c @@ -0,0 +1,122 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Input Power Event -> APM Bridge + * + * Copyright (c) 2007 Richard Purdie + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include +#include +#include +#include +#include +#include +#include +#include + +static void system_power_event(unsigned int keycode) +{ + switch (keycode) { + case KEY_SUSPEND: + apm_queue_event(APM_USER_SUSPEND); + pr_info("Requesting system suspend...\n"); + break; + default: + break; + } +} + +static void apmpower_event(struct input_handle *handle, unsigned int type, + unsigned int code, int value) +{ + /* only react on key down events */ + if (value != 1) + return; + + switch (type) { + case EV_PWR: + system_power_event(code); + break; + + default: + break; + } +} + +static int apmpower_connect(struct input_handler *handler, + struct input_dev *dev, + const struct input_device_id *id) +{ + struct input_handle *handle; + int error; + + handle = kzalloc_obj(struct input_handle); + if (!handle) + return -ENOMEM; + + handle->dev = dev; + handle->handler = handler; + handle->name = "apm-power"; + + error = input_register_handle(handle); + if (error) { + pr_err("Failed to register input power handler, error %d\n", + error); + kfree(handle); + return error; + } + + error = input_open_device(handle); + if (error) { + pr_err("Failed to open input power device, error %d\n", error); + input_unregister_handle(handle); + kfree(handle); + return error; + } + + return 0; +} + +static void apmpower_disconnect(struct input_handle *handle) +{ + input_close_device(handle); + input_unregister_handle(handle); + kfree(handle); +} + +static const struct input_device_id apmpower_ids[] = { + { + .flags = INPUT_DEVICE_ID_MATCH_EVBIT, + .evbit = { BIT_MASK(EV_PWR) }, + }, + { }, +}; + +MODULE_DEVICE_TABLE(input, apmpower_ids); + +static struct input_handler apmpower_handler = { + .event = apmpower_event, + .connect = apmpower_connect, + .disconnect = apmpower_disconnect, + .name = "apm-power", + .id_table = apmpower_ids, +}; + +static int __init apmpower_init(void) +{ + return input_register_handler(&apmpower_handler); +} + +static void __exit apmpower_exit(void) +{ + input_unregister_handler(&apmpower_handler); +} + +module_init(apmpower_init); +module_exit(apmpower_exit); + +MODULE_AUTHOR("Richard Purdie "); +MODULE_DESCRIPTION("Input Power Event -> APM Bridge"); +MODULE_LICENSE("GPL"); -- cgit v1.3.1