Re: [PATCH] dmaengine: Fix device kref underflow in dma_chan_put()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Pre-existing Use-After-Free vulnerabilities in dma_chan_put() and dma_release_channel() due to device memory release before teardown completes.
--

commit dcce1cbcc027c7a50b03bed56fe875a7390be677
Author: Shivank Garg <shivankg@amd.com>

dmaengine: Fix device kref underflow in dma_chan_put()

This commit addresses a device kref underflow by ensuring the device reference
is only dropped when the client count reaches zero, matching the slow-path get.

> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -515,7 +515,9 @@ static void dma_chan_put(struct dma_chan *chan)
>  		chan->route_data = NULL;
>  	}
>  
> -	dma_device_put(chan->device);
> +	/* This channel is not in use anymore, drop the device ref */
> +	if (!chan->client_count)
> +		dma_device_put(chan->device);
>  	module_put(dma_chan_to_owner(chan));
>  }

This isn't a bug introduced by this patch, but does this sequence present
a use-after-free risk?

If dma_device_put() drops the final reference to the device (for example,
if the provider module previously unregistered the DMA device), it can
trigger the device release callback and free the dma_device and dma_chan
memory.

If that happens, module_put(dma_chan_to_owner(chan)) will dereference the
freed memory, as dma_chan_to_owner() accesses chan->device->owner.

Additionally, when dma_chan_put() is called from dma_release_channel(),
returning from this function leads to further accesses of the freed memory.
dma_release_channel() continues to access chan->device->privatecnt,
chan->device->cap_mask, chan->slave, and chan->name, which could cause a
series of use-after-free issues during teardown or hot-unplug.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518-dmaengine-kref-fix-v1-1-4d6125048fb7@amd.com?part=1