From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- include/soc/amlogic/meson_ddr_pmu.h | 66 +++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 include/soc/amlogic/meson_ddr_pmu.h (limited to 'include/soc/amlogic') diff --git a/include/soc/amlogic/meson_ddr_pmu.h b/include/soc/amlogic/meson_ddr_pmu.h new file mode 100644 index 000000000..4a33e4ab8 --- /dev/null +++ b/include/soc/amlogic/meson_ddr_pmu.h @@ -0,0 +1,66 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2022 Amlogic, Inc. All rights reserved. + */ + +#ifndef __MESON_DDR_PMU_H__ +#define __MESON_DDR_PMU_H__ + +#define MAX_CHANNEL_NUM 8 + +enum { + ALL_CHAN_COUNTER_ID, + CHAN1_COUNTER_ID, + CHAN2_COUNTER_ID, + CHAN3_COUNTER_ID, + CHAN4_COUNTER_ID, + CHAN5_COUNTER_ID, + CHAN6_COUNTER_ID, + CHAN7_COUNTER_ID, + CHAN8_COUNTER_ID, + COUNTER_MAX_ID, +}; + +struct dmc_info; + +struct dmc_counter { + u64 all_cnt; /* The count of all requests come in/out ddr controller */ + union { + u64 all_req; + struct { + u64 all_idle_cnt; + u64 all_16bit_cnt; + }; + }; + u64 channel_cnt[MAX_CHANNEL_NUM]; /* To save a DMC bandwidth-monitor channel counter */ +}; + +struct dmc_hw_info { + void (*enable)(struct dmc_info *info); + void (*disable)(struct dmc_info *info); + /* Bind an axi line to a bandwidth-monitor channel */ + void (*set_axi_filter)(struct dmc_info *info, int axi_id, int chann); + int (*irq_handler)(struct dmc_info *info, + struct dmc_counter *counter); + void (*get_counters)(struct dmc_info *info, + struct dmc_counter *counter); + + int dmc_nr; /* The number of dmc controller */ + int chann_nr; /* The number of dmc bandwidth monitor channels */ + struct attribute **fmt_attr; + const u64 capability[2]; +}; + +struct dmc_info { + const struct dmc_hw_info *hw_info; + + void __iomem *ddr_reg[4]; + unsigned long timer_value; /* Timer value in TIMER register */ + void __iomem *pll_reg; + int irq_num; /* irq vector number */ +}; + +int meson_ddr_pmu_create(struct platform_device *pdev); +int meson_ddr_pmu_remove(struct platform_device *pdev); + +#endif /* __MESON_DDR_PMU_H__ */ -- cgit v1.3.1