From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001
From: Shivank Garg <shivankg@amd.com>
Date: Sat, 22 Aug 2026 19:22:05 +0000
Subject: dmaengine: fix use-after-free in dma_chan_put() and
 dma_release_channel()

When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.

dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:

	slab-use-after-free in dma_chan_put+0x3e6/0x4c0
	Read of size 8 by task insmod/6319
	Freed by task 6319:
	  kfree+0x225/0x470
	  dma_chan_put+0x395/0x4c0
	  dmaengine_put+0xf8/0x160

Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.

Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Suggested-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
---
 rust/syn/drops.rs | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 rust/syn/drops.rs

(limited to 'rust/syn/drops.rs')

diff --git a/rust/syn/drops.rs b/rust/syn/drops.rs
new file mode 100644
index 000000000..2c4ae333d
--- /dev/null
+++ b/rust/syn/drops.rs
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+use std::iter;
+use std::mem::ManuallyDrop;
+use std::ops::{Deref, DerefMut};
+use std::option;
+use std::slice;
+
+#[repr(transparent)]
+pub(crate) struct NoDrop<T: ?Sized>(ManuallyDrop<T>);
+
+impl<T> NoDrop<T> {
+    pub(crate) fn new(value: T) -> Self
+    where
+        T: TrivialDrop,
+    {
+        NoDrop(ManuallyDrop::new(value))
+    }
+}
+
+impl<T: ?Sized> Deref for NoDrop<T> {
+    type Target = T;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl<T: ?Sized> DerefMut for NoDrop<T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+pub(crate) trait TrivialDrop {}
+
+impl<T> TrivialDrop for iter::Empty<T> {}
+impl<T> TrivialDrop for slice::Iter<'_, T> {}
+impl<T> TrivialDrop for slice::IterMut<'_, T> {}
+impl<T> TrivialDrop for option::IntoIter<&T> {}
+impl<T> TrivialDrop for option::IntoIter<&mut T> {}
+
+#[test]
+fn test_needs_drop() {
+    use std::mem::needs_drop;
+
+    struct NeedsDrop;
+
+    impl Drop for NeedsDrop {
+        fn drop(&mut self) {}
+    }
+
+    assert!(needs_drop::<NeedsDrop>());
+
+    // Test each of the types with a handwritten TrivialDrop impl above.
+    assert!(!needs_drop::<iter::Empty<NeedsDrop>>());
+    assert!(!needs_drop::<slice::Iter<NeedsDrop>>());
+    assert!(!needs_drop::<slice::IterMut<NeedsDrop>>());
+    assert!(!needs_drop::<option::IntoIter<&NeedsDrop>>());
+    assert!(!needs_drop::<option::IntoIter<&mut NeedsDrop>>());
+}
-- 
cgit v1.3.1