From e873c74132f0c5f1452816cd9bb26208f0bba1e1 Mon Sep 17 00:00:00 2001 From: Shivank Garg Date: Sat, 22 Aug 2026 19:22:05 +0000 Subject: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_device along with its channels. dma_chan_put() then still reads chan->device->owner via dma_chan_to_owner() for the trailing module_put(). KASAN catches it: slab-use-after-free in dma_chan_put+0x3e6/0x4c0 Read of size 8 by task insmod/6319 Freed by task 6319: kfree+0x225/0x470 dma_chan_put+0x395/0x4c0 dmaengine_put+0xf8/0x160 Cache the module owner in dma_chan_put() before the put so the trailing module_put() does not need chan->device. Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct") Suggested-by: Sashiko Link: https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com Reviewed-by: Frank Li Reviewed-by: Logan Gunthorpe Signed-off-by: Shivank Garg Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-3-d4a4ee47d927@amd.com Signed-off-by: Vinod Koul --- scripts/const_structs.checkpatch | 113 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) create mode 100644 scripts/const_structs.checkpatch (limited to 'scripts/const_structs.checkpatch') diff --git a/scripts/const_structs.checkpatch b/scripts/const_structs.checkpatch new file mode 100644 index 000000000..6eb94fddc --- /dev/null +++ b/scripts/const_structs.checkpatch @@ -0,0 +1,113 @@ +acpi_dock_ops +address_space_operations +backlight_ops +bin_attribute +block_device_operations +bus_type +clk_ops +comedi_lrange +component_ops +ctl_table +dentry_operations +dev_pm_ops +device_type +dma_map_ops +driver_info +drm_connector_funcs +drm_encoder_funcs +drm_encoder_helper_funcs +dvb_frontend_ops +dvb_tuner_ops +ethtool_ops +extent_io_ops +fb_ops +file_lock_operations +file_operations +hv_ops +hwmon_ops +ib_device_ops +ide_dma_ops +ide_port_ops +ieee80211_ops +iio_buffer_setup_ops +inode_operations +intel_dvo_dev_ops +irq_domain_ops +item_operations +iwl_cfg +iwl_ops +kernel_param_ops +kgdb_arch +kgdb_io +kobj_type +kset_uevent_ops +lcd_ops +lock_manager_operations +machine_desc +microcode_ops +mlxsw_reg_info +mtd_ooblayout_ops +mtrr_ops +nand_controller_ops +neigh_ops +net_device_ops +nft_expr_ops +nlmsvc_binding +nvkm_device_chip +of_device_id +pci_raw_ops +phy_ops +pinconf_ops +pinctrl_ops +pinmux_ops +pipe_buf_operations +platform_hibernation_ops +platform_suspend_ops +proc_ops +proto_ops +pwm_ops +reg_default +reg_field +reg_sequence +regmap_access_table +regmap_bus +regmap_config +regmap_irq +regmap_irq_chip +regmap_irq_sub_irq_map +regmap_range +regmap_range_cfg +regulator_ops +reset_control_ops +rpc_pipe_ops +rtc_class_ops +sd_desc +sdhci_ops +seq_operations +sirfsoc_padmux +snd_ac97_build_ops +snd_pcm_ops +snd_rawmidi_ops +snd_soc_component_driver +snd_soc_dai_ops +snd_soc_ops +snd_soc_tplg_ops +soc_pcmcia_socket_ops +stacktrace_ops +sysfs_ops +tty_operations +uart_ops +usb_mon_operations +v4l2_ctrl_ops +v4l2_ioctl_ops +v4l2_subdev_core_ops +v4l2_subdev_internal_ops +v4l2_subdev_ops +v4l2_subdev_pad_ops +v4l2_subdev_video_ops +vb2_ops +vm_operations_struct +wacom_features +watchdog_ops +wd_ops +xattr_handler -- cgit v1.3.1