diff options
| author | Shivank Garg <shivankg@amd.com> | 2026-08-22 19:22:04 +0000 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-09 17:51:44 +0530 |
| commit | 44dab659064eb5c10adb0306510eebe848ed592d (patch) | |
| tree | b5a1d31faaf1f49d0f621bd489f3a755574829eb | |
| parent | 424103642d009f5a7dc33300a49d5606d1bf4fb5 (diff) | |
| download | linux-next-44dab659064eb5c10adb0306510eebe848ed592d.tar.gz linux-next-44dab659064eb5c10adb0306510eebe848ed592d.zip | |
dmaengine: Fix device kref underflow in dma_chan_put()
dma_chan_get() takes chan->device->ref only on the slow path:
/* no kref on fast path */
if (chan->client_count) {
__module_get(owner);
chan->client_count++;
return 0;
}
if (!try_module_get(owner))
return -ENODEV;
if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()
dma_chan_put() drops the ref unconditionally, so every fast-path
get/put pair drops one extra device reference.
The bug fires when two conditions hold together: a non-private
provider has a persistent client holding chan->client_count > 0
and another client cycles dmaengine_get()/dmaengine_put().
When the kref hits zero, the subsequent dma_find_channel() returns
NULL even though the provider module is still loaded.
Fix this by dropping device->ref only on the last put, matching the
single slow-path get.
Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
Link: https://patch.msgid.link/20260822-dmaengine-kref-fix-v5-2-d4a4ee47d927@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
| -rw-r--r-- | drivers/dma/dmaengine.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 6b8af8607e5c..e380b801df73 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -520,7 +520,9 @@ static void dma_chan_put(struct dma_chan *chan) chan->route_data = NULL; } - dma_device_put(chan->device); + /* This channel is not in use anymore, drop the device ref */ + if (!chan->client_count) + dma_device_put(chan->device); module_put(dma_chan_to_owner(chan)); } |