dmaengine: fix broken device refcounting (348badf1) · Commits · 戴 / test

When a DMA device is unregistered, its reference count is decremented twice for each channel: Once dma_class_dev_release() and once in dma_chan_cleanup(). This may result in the DMA device driver's remove() function completing before all channels have been cleaned up, causing lots of use-after-free fun. Fix it by incrementing the device's reference count twice for each channel during registration. [dan.j.williams@intel.com: kill unnecessary client refcounting] Signed-off-by:

Haavard Skinnemoen <hskinnemoen@atmel.com> Signed-off-by:

Dan Williams <dan.j.williams@intel.com> Signed-off-by:

Shannon Nelson <shannon.nelson@intel.com> Cc: <stable@kernel.org> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

drivers/dma/dmaengine.c

+6 −11

Original line number	Diff line number	Diff line
		@@ -182,10 +182,9 @@ static void dma_client_chan_alloc(struct dma_client *client)
		/* we are done once this client rejects
		* an available resource
		*/
		if (ack == DMA_ACK) {
		if (ack == DMA_ACK)
		dma_chan_get(chan);
		kref_get(&device->refcount);
		} else if (ack == DMA_NAK)
		else if (ack == DMA_NAK)
		return;
		}
		}
		@@ -272,11 +271,8 @@ static void dma_clients_notify_removed(struct dma_chan *chan)
		/* client was holding resources for this channel so
		* free it
		*/
		if (ack == DMA_ACK) {
		if (ack == DMA_ACK)
		dma_chan_put(chan);
		kref_put(&chan->device->refcount,
		dma_async_device_cleanup);
		}
		}

		mutex_unlock(&dma_list_mutex);
		@@ -316,11 +312,8 @@ void dma_async_client_unregister(struct dma_client *client)
		ack = client->event_callback(client, chan,
		DMA_RESOURCE_REMOVED);

		if (ack == DMA_ACK) {
		if (ack == DMA_ACK)
		dma_chan_put(chan);
		kref_put(&chan->device->refcount,
		dma_async_device_cleanup);
		}
		}

		list_del(&client->global_node);
		@@ -397,6 +390,8 @@ int dma_async_device_register(struct dma_device *device)
		goto err_out;
		}

		/* One for the channel, one of the class device */
		kref_get(&device->refcount);
		kref_get(&device->refcount);
		kref_init(&chan->refcount);
		chan->slow_ref = 0;

Admin message