From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- fs/unicode/README.utf8data | 57 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 fs/unicode/README.utf8data (limited to 'fs/unicode/README.utf8data') diff --git a/fs/unicode/README.utf8data b/fs/unicode/README.utf8data new file mode 100644 index 000000000..f75567e28 --- /dev/null +++ b/fs/unicode/README.utf8data @@ -0,0 +1,57 @@ +The utf8data.c file in this directory is generated from the Unicode +Character Database for version 12.1.0 of the Unicode standard. + +The full set of files can be found here: + + http://www.unicode.org/Public/12.1.0/ucd/ + +Individual source links: + + https://www.unicode.org/Public/12.1.0/ucd/CaseFolding.txt + https://www.unicode.org/Public/12.1.0/ucd/DerivedAge.txt + https://www.unicode.org/Public/12.1.0/ucd/extracted/DerivedCombiningClass.txt + https://www.unicode.org/Public/12.1.0/ucd/DerivedCoreProperties.txt + https://www.unicode.org/Public/12.1.0/ucd/NormalizationCorrections.txt + https://www.unicode.org/Public/12.1.0/ucd/NormalizationTest.txt + https://www.unicode.org/Public/12.1.0/ucd/UnicodeData.txt + +md5sums (verify by running "md5sum -c README.utf8data"): + + 900e76da1d822a160fd6b8c0b1d70094 CaseFolding.txt + 131256380bff4fea8ad4a851616f2f10 DerivedAge.txt + e731a4089b30002144e107e3d6f8d1fa DerivedCombiningClass.txt + a47c9fbd7ff92a9b261ba9831e68778a DerivedCoreProperties.txt + fcab6dad15e440879d92f315978f93d3 NormalizationCorrections.txt + f9ff1c55a60decf436100f791b44aa98 NormalizationTest.txt + 755f6af699f8c8d2d958da411f78f6c6 UnicodeData.txt + +sha1sums (verify by running "sha1sum -c README.utf8data"): + + dc9245f6803c4ac99555c361f5052e0b13eb779b CaseFolding.txt + 3281104f237184cdb5d869e86eb8573678ada7da DerivedAge.txt + 2f5f995ccb96e0fa84b15151b35d5e2681535175 DerivedCombiningClass.txt + 5b8698a3fcd5018e1987f296b02e2c17e696415e DerivedCoreProperties.txt + cd83935fbc012345d8792d2c704f69497e753835 NormalizationCorrections.txt + ea419aae505b337b0d99a83fa83fe58ddff7c19f NormalizationTest.txt + dc973c0fc93d6f09d9ab9f70d1c9f89c447f0526 UnicodeData.txt + + +To update to the newer version of the Unicode standard, the latest +released version of the UCD can be found here: + + http://www.unicode.org/Public/UCD/latest/ + +Then, build under fs/unicode/ with REGENERATE_UTF8DATA=1: + + make REGENERATE_UTF8DATA=1 fs/unicode/ + +After sanity checking the newly generated utf8data.c file (the +version generated from the 12.1.0 UCD should be 4,109 lines long, and +have a total size of 324k) and/or comparing it with the older version +of utf8data.c_shipped, rename it to utf8data.c_shipped. + +If you are a kernel developer updating to a newer version of the +Unicode Character Database, please update this README.utf8data file +with the version of the UCD that was used, the md5sum and sha1sums of +the *.txt files, before checking in the new versions of the utf8data.c +and README.utf8data files. -- cgit v1.3.1