Patch "dma: fix call order in dmam_free_coherent" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dma: fix call order in dmam_free_coherent

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dma-fix-call-order-in-dmam_free_coherent.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0dde245834ef58da29c6dd71fd7ac69f3c100b6a
Author: Lance Richardson <rlance@xxxxxxxxxx>
Date:   Thu Jul 18 14:38:24 2024 +0000

    dma: fix call order in dmam_free_coherent
    
    [ Upstream commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 ]
    
    dmam_free_coherent() frees a DMA allocation, which makes the
    freed vaddr available for reuse, then calls devres_destroy()
    to remove and free the data structure used to track the DMA
    allocation. Between the two calls, it is possible for a
    concurrent task to make an allocation with the same vaddr
    and add it to the devres list.
    
    If this happens, there will be two entries in the devres list
    with the same vaddr and devres_destroy() can free the wrong
    entry, triggering the WARN_ON() in dmam_match.
    
    Fix by destroying the devres entry before freeing the DMA
    allocation.
    
    Tested:
      kokonut //net/encryption
        http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
    
    Fixes: 9ac7849e35f7 ("devres: device resource management")
    Signed-off-by: Lance Richardson <rlance@xxxxxxxxxx>
    Signed-off-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
index c9dbc8f5812b8..9e1a724ae7e7d 100644
--- a/kernel/dma/mapping.c
+++ b/kernel/dma/mapping.c
@@ -62,8 +62,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr,
 {
 	struct dma_devres match_data = { size, vaddr, dma_handle };
 
-	dma_free_coherent(dev, size, vaddr, dma_handle);
 	WARN_ON(devres_destroy(dev, dmam_release, dmam_match, &match_data));
+	dma_free_coherent(dev, size, vaddr, dma_handle);
 }
 EXPORT_SYMBOL(dmam_free_coherent);