Re: [PATCH v3 1/3] dmaengine: Fix device kref underflow in dma_chan_put()

[Garg, Shivank]

On Mon, 2026-08-17 at 09:17 -0500, Frank Li wrote:
> [You don't often get email from frank.li@xxxxxxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Sun, Aug 16, 2026 at 03:49:25PM +0000, Shivank Garg wrote:
> > [You don't often get email from shivankg@xxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> > 
> > dma_chan_get() takes chan->device->ref only on the slow path:
> > 
> >         /* no kref on fast path */
> >         if (chan->client_count) {
> >                 __module_get(owner);
> >                 chan->client_count++;
> >                 return 0;
> >         }
> >         if (!try_module_get(owner))
> >                 return -ENODEV;
> >         ret = kref_get_unless_zero(&chan->device->ref);
> > 
> > dma_chan_put() drops the ref unconditionally, so every fast-path
> > get/put pair drops one extra device reference.
> > 
> > The bug fires when two conditions hold together: a non-private
> > provider has a persistent client holding chan->client_count > 0
> > and another client cycles dmaengine_get()/dmaengine_put().
> > When the kref hits zero, the subsequent dma_find_channel() returns
> > NULL even though the provider module is still loaded.
> > 
> > Fix this by dropping device->ref only on the last put, matching the
> > single slow-path get.
> > 
> > Fixes: 8ad342a86359 ("dmaengine: Add reference counting to dma_device struct")
> > Signed-off-by: Shivank Garg <shivankg@xxxxxxx>
> > ---
> 
> Nit: add helper dma_device_get() to match dma_device_put() to make code
> more symmetry.

Ack.

> 
> Reviewed-by: Frank Li <Frank.Li@xxxxxxx>
> 
> 

Thanks for the review.

Best regards,
Shivank