Re: [PATCH v10 11/19] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c
flat view
From: sashiko-bot@kernel.org
Date: 2026-09-28 03:13:35
Also in:
dmaengine
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] dmaengine: ti: k3-udma: UAF due to broken module dependency -- commit f3615f5a550ae951b71ca33c0cf4afbecff775f7 Author: Sai Sree Kartheek Adivi [off-list ref] dmaengine: ti: k3-udma: move inclusion of k3-udma-private.c to k3-udma-common.c Relocates the inclusion of k3-udma-private.c to k3-udma-common.c so that the code can be shared between other UDMA variants. This is intended to improve modularity without introducing functional changes.
quoted hunk ↗ jump to hunk
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c index d0afbab01786f..eb555cc08347d 100644 --- a/drivers/dma/ti/k3-udma-common.c +++ b/drivers/dma/ti/k3-udma-common.c@@ -2536,3 +2536,6 @@ EXPORT_SYMBOL_GPL(k3_udma_setup_resources); MODULE_DESCRIPTION("Texas Instruments K3 UDMA Common Library"); MODULE_LICENSE("GPL v2"); + +/* Private interfaces to UDMA */ +#include "k3-udma-private.c"
[Severity: High]
Does moving this include into k3-udma-common.c inadvertently break the module
dependency that keeps k3-udma.c from being unloaded while in use?
By moving the exported symbols from k3-udma-private.c into k3-udma-common.ko,
the dependency of client modules (like k3-udma-glue) shifts away from the
main hardware driver k3-udma.ko.
If a client uses k3-udma-glue APIs to obtain the devm-allocated context via
of_xudma_dev_get(), the device reference is explicitly dropped:
drivers/dma/ti/k3-udma-private.c:of_xudma_dev_get() {
...
ud = platform_get_drvdata(pdev);
put_device(&pdev->dev);
...
}
Because these APIs bypass the standard DMA engine core which normally calls
try_module_get(), k3-udma.ko is left with a module reference count of 0.
Could this allow k3-udma.ko to be unloaded while the client still actively
uses the dangling pointer, resulting in a use-after-free when the devm
resources are released?
quoted hunk ↗ jump to hunk
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index 9a261747c8709..ddedd51ab26d9 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c@@ -2857,5 +2857,3 @@ module_platform_driver(udma_driver); MODULE_DESCRIPTION("Texas Instruments UDMA support"); MODULE_LICENSE("GPL v2"); -/* Private interfaces to UDMA */ -#include "k3-udma-private.c"
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260928025749.1055383-1-s-adivi@ti.com?part=11