All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Garg, Shivank" <shivankg@amd.com>
To: "Frank.li@oss.nxp.com" <Frank.li@oss.nxp.com>
Cc: "dmaengine@vger.kernel.org" <dmaengine@vger.kernel.org>,
	"vkoul@kernel.org" <vkoul@kernel.org>,
	"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
	"sashiko-bot@kernel.org" <sashiko-bot@kernel.org>,
	"Frank.Li@kernel.org" <Frank.Li@kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"logang@deltatee.com" <logang@deltatee.com>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH v3 3/3] dmaengine: wait for RCU readers before releasing dma_device
Date: Tue, 18 Aug 2026 03:31:45 +0000	[thread overview]
Message-ID: <3491f5895e3d3592907a12f75cf049609dd05964.camel@amd.com> (raw)
In-Reply-To: <aoMa1GTFd-R0Ep6J@SMW015318>

On Mon, 2026-08-17 at 09:29 -0500, Frank Li wrote:
> [You don't often get email from frank.li@oss.nxp.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Sun, Aug 16, 2026 at 03:49:27PM +0000, Shivank Garg wrote:
> > [You don't often get email from shivankg@amd.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> > 
> > dma_issue_pending_all() walks the dma_device_list with
> > list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()
> > unlinks the device with list_del_rcu() and then calls
> > device->device_release() (which in many drivers, such as plx_dma.c,
> > directly calls kfree()).
> > 
> > Because there is no grace period between unlinking the device and
> > freeing it, concurrent RCU readers in dma_issue_pending_all() can
> > access the device after it has been freed.
> > 
> > The lockless walk originally relied on clients holding a dmaengine
> > reference to pin the provider module, and therefore the device, for as
> > long as they might traverse the list. Commit 8ad342a86359 ("dmaengine:
> > Add reference counting to dma_device struct") decoupled the dma_device
> > lifetime from the module reference, so the device can now be released
> > while a reader is still walking the list.
> > 
> > Add synchronize_rcu() before the device is freed, so RCU readers are
> > guaranteed to have finished. Keep it unconditional: providers that do
> > not implement device_release() free the device themselves once
> > dma_async_device_unregister() returns, so they need the same grace
> > period.
> > 
> > Fixes: 2ba05622b8b1 ("dmaengine: provide a common 'issue_pending_all' implementation")
> > Suggested-by: Sashiko <sashiko-bot@kernel.org>
> > Link: https://sashiko.dev/#/patchset/20260526-dmaengine-kref-fix-v2-0-3df60afac01d@amd.com
> > Signed-off-by: Shivank Garg <shivankg@amd.com>
> > ---
> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> 
> > 

Thank you for the review.

Best regards,
Shivank

      reply	other threads:[~2026-08-18  3:31 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-16 15:49 [PATCH v3 0/3] dmaengine: fix kref underflow and UAF in dma_chan_put() Shivank Garg
2026-08-16 15:49 ` [PATCH v3 1/3] dmaengine: Fix device kref underflow " Shivank Garg
2026-08-16 16:02   ` sashiko-bot
2026-08-16 18:14     ` Garg, Shivank
2026-08-17 14:17   ` Frank Li
2026-08-18  3:32     ` Garg, Shivank
2026-08-16 15:49 ` [PATCH v3 2/3] dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() Shivank Garg
2026-08-16 16:07   ` sashiko-bot
2026-08-16 18:05     ` Garg, Shivank
2026-08-17 14:26       ` Frank Li
2026-08-18  3:31         ` Garg, Shivank
2026-08-17 14:24   ` Frank Li
2026-08-16 15:49 ` [PATCH v3 3/3] dmaengine: wait for RCU readers before releasing dma_device Shivank Garg
2026-08-16 16:10   ` sashiko-bot
2026-08-17 14:29   ` Frank Li
2026-08-18  3:31     ` Garg, Shivank [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3491f5895e3d3592907a12f75cf049609dd05964.camel@amd.com \
    --to=shivankg@amd.com \
    --cc=Frank.Li@kernel.org \
    --cc=Frank.li@oss.nxp.com \
    --cc=akpm@linux-foundation.org \
    --cc=dmaengine@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=logang@deltatee.com \
    --cc=sashiko-bot@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=vkoul@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.