Re: [PATCH v4 3/4] dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in dma_release_channel() due to accessing 'chan' after dropping its reference via dma_chan_put()
--

--- Patch [3]: [PATCH v4 3/4] dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() ---
commit 4ca601ffe76f0ae6fcc1118c90ce61d882e870d0
Author: Shivank Garg <[email protected]>

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

This commit addresses a use-after-free in dma_chan_put() where the channel's
device owner is accessed after the device reference is dropped. It caches the
module owner before calling dma_device_put() to prevent KASAN warnings.

Link: https://sashiko.dev/#/patchset/[email protected]

> dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

[Severity: High]
This is a pre-existing issue, but the commit title mentions fixing a
use-after-free in dma_release_channel(), yet the patch doesn't modify that
function.

Looking at dma_release_channel() in drivers/dma/dmaengine.c, there appears to
still be a use-after-free if dma_chan_put() drops the last reference and frees
the channel:

void dma_release_channel(struct dma_chan *chan)
{
	...
	dma_chan_put(chan);

	if (chan->slave) {
		sysfs_remove_link(&chan->dev->device.kobj, DMA_SLAVE_NAME);
		sysfs_remove_link(&chan->slave->kobj, chan->name);
		kfree(chan->name);
		...
	}
	...
}

Does this code still cause a use-after-free if dma_chan_put() triggers the
release of the dma_device and its embedded channel structures?

If the underlying DMA device has been unregistered, dropping the channel's
client count could drop the final dma_device kref and free the channel. The
subsequent accesses to chan->slave, chan->dev, and chan->name would then
dereference freed memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3