From: "Garg, Shivank" <shivankg@amd.com>
To: "Frank.li@oss.nxp.com" <Frank.li@oss.nxp.com>
Cc: "dmaengine@vger.kernel.org" <dmaengine@vger.kernel.org>,
"vkoul@kernel.org" <vkoul@kernel.org>,
"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
"sashiko-bot@kernel.org" <sashiko-bot@kernel.org>,
"Frank.Li@kernel.org" <Frank.Li@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"logang@deltatee.com" <logang@deltatee.com>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH v3 3/3] dmaengine: wait for RCU readers before releasing dma_device
Date: Tue, 18 Aug 2026 03:31:45 +0000 [thread overview]
Message-ID: <3491f5895e3d3592907a12f75cf049609dd05964.camel@amd.com> (raw)
In-Reply-To: <aoMa1GTFd-R0Ep6J@SMW015318>
On Mon, 2026-08-17 at 09:29 -0500, Frank Li wrote:
> [You don't often get email from frank.li@oss.nxp.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> On Sun, Aug 16, 2026 at 03:49:27PM +0000, Shivank Garg wrote:
> > [You don't often get email from shivankg@amd.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> >
> > dma_issue_pending_all() walks the dma_device_list with
> > list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()
> > unlinks the device with list_del_rcu() and then calls
> > device->device_release() (which in many drivers, such as plx_dma.c,
> > directly calls kfree()).
> >
> > Because there is no grace period between unlinking the device and
> > freeing it, concurrent RCU readers in dma_issue_pending_all() can
> > access the device after it has been freed.
> >
> > The lockless walk originally relied on clients holding a dmaengine
> > reference to pin the provider module, and therefore the device, for as
> > long as they might traverse the list. Commit 8ad342a86359 ("dmaengine:
> > Add reference counting to dma_device struct") decoupled the dma_device
> > lifetime from the module reference, so the device can now be released
> > while a reader is still walking the list.
> >
> > Add synchronize_rcu() before the device is freed, so RCU readers are
> > guaranteed to have finished. Keep it unconditional: providers that do
> > not implement device_release() free the device themselves once
> > dma_async_device_unregister() returns, so they need the same grace
> > period.
> >
> > Fixes: 2ba05622b8b1 ("dmaengine: provide a common 'issue_pending_all' implementation")
> > Suggested-by: Sashiko <sashiko-bot@kernel.org>
> > Link: https://sashiko.dev/#/patchset/20260526-dmaengine-kref-fix-v2-0-3df60afac01d@amd.com
> > Signed-off-by: Shivank Garg <shivankg@amd.com>
> > ---
>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
>
> >
Thank you for the review.
Best regards,
Shivank
prev parent reply other threads:[~2026-08-18 3:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-16 15:49 [PATCH v3 0/3] dmaengine: fix kref underflow and UAF in dma_chan_put() Shivank Garg
2026-08-16 15:49 ` [PATCH v3 1/3] dmaengine: Fix device kref underflow " Shivank Garg
2026-08-17 14:17 ` Frank Li
2026-08-18 3:32 ` Garg, Shivank
2026-08-16 15:49 ` [PATCH v3 2/3] dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() Shivank Garg
2026-08-17 14:24 ` Frank Li
2026-08-16 15:49 ` [PATCH v3 3/3] dmaengine: wait for RCU readers before releasing dma_device Shivank Garg
2026-08-17 14:29 ` Frank Li
2026-08-18 3:31 ` Garg, Shivank [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3491f5895e3d3592907a12f75cf049609dd05964.camel@amd.com \
--to=shivankg@amd.com \
--cc=Frank.Li@kernel.org \
--cc=Frank.li@oss.nxp.com \
--cc=akpm@linux-foundation.org \
--cc=dmaengine@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=logang@deltatee.com \
--cc=sashiko-bot@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®