Re: [PATCH v10 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dmaengine: ti: k3-udma: UAF due to broken module dependency
--

commit f3615f5a550ae951b71ca33c0cf4afbecff775f7
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>

dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c

Relocates the inclusion of k3-udma-private.c to k3-udma-common.c so that
the code can be shared between other UDMA variants. This is intended to
improve modularity without introducing functional changes.

> diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
> index d0afbab01786f..eb555cc08347d 100644
> --- a/drivers/dma/ti/k3-udma-common.c
> +++ b/drivers/dma/ti/k3-udma-common.c
> @@ -2536,3 +2536,6 @@ EXPORT_SYMBOL_GPL(k3_udma_setup_resources);
>  
>  MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library");
>  MODULE_LICENSE("GPL v2");
> +
> +/* Private interfaces to UDMA */
> +#include "k3-udma-private.c"

[Severity: High]
Does moving this include into k3-udma-common.c inadvertently break the module
dependency that keeps k3-udma.c from being unloaded while in use?

By moving the exported symbols from k3-udma-private.c into k3-udma-common.ko,
the dependency of client modules (like k3-udma-glue) shifts away from the
main hardware driver k3-udma.ko.

If a client uses k3-udma-glue APIs to obtain the devm-allocated context via
of_xudma_dev_get(), the device reference is explicitly dropped:

drivers/dma/ti/k3-udma-private.c:of_xudma_dev_get() {
    ...
	ud = platform_get_drvdata(pdev);
	put_device(&pdev->dev);
    ...
}

Because these APIs bypass the standard DMA engine core which normally calls
try_module_get(), k3-udma.ko is left with a module reference count of 0.

Could this allow k3-udma.ko to be unloaded while the client still actively
uses the dangling pointer, resulting in a use-after-free when the devm
resources are released?

> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 9a261747c8709..ddedd51ab26d9 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
> @@ -2857,5 +2857,3 @@ module_platform_driver(udma_driver);
>  MODULE_DESCRIPTION("Texas Instruments UDMA support");
>  MODULE_LICENSE("GPL v2");
>  
> -/* Private interfaces to UDMA */
> -#include "k3-udma-private.c"

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928025749.1055383-1-s-adivi@ti.com?part=11