Re: [PATCH] hwmon: (lm90) Only report alarms if driver is ready

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete Fix / Use-After-Free and NULL Pointer Dereference via alert_work
--

--- Patch [1]: [PATCH] hwmon: (lm90) Only report alarms if driver is ready ---
commit 79dff8acd6e841981f1482b13b5476e90ffaad24
Author: Guenter Roeck <[email protected]>

hwmon: (lm90) Only report alarms if driver is ready

This commit fixes a NULL pointer dereference by ensuring report_work is
only scheduled if data->hwmon_dev is set. This prevents a crash when
userspace reads sysfs attributes before driver registration completes.

> diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
> index 4b9c0ccdf2609..b03f75f4ddec2 100644
> --- a/drivers/hwmon/lm90.c
> +++ b/drivers/hwmon/lm90.c
> @@ -1194,7 +1194,7 @@ static int lm90_update_alarms_locked(struct lm90_data *data, bool force)
>  		check_enable = (client->irq || !(data->config_orig & 0x80)) &&
>  			(data->config & 0x80);
>  
> -		if (force || check_enable)
> +		if (data->hwmon_dev && (force || check_enable))
>  			schedule_work(&data->report_work);
>  
>  		/*

[Severity: High]
This is a pre-existing issue, but does this fix also need to be applied
to alert_work scheduled further down in this function?

If userspace reads an attribute during the registration window and alarms
are active, it looks like alert_work can still be scheduled while
data->hwmon_dev is NULL:

drivers/hwmon/lm90.c:lm90_update_alarms_locked() {
    ...
		if (check_enable) {
			if (!(data->current_alarms & data->alert_alarms)) {
				...
			} else {
				schedule_delayed_work(&data->alert_work,
					max_t(int, HZ, msecs_to_jiffies(data->update_interval)));
			}
		}
    ...
}

If devm_hwmon_device_register_with_info() subsequently fails in lm90_probe(),
devres frees the data structure. Since lm90_stop_work hasn't been registered
yet on this error path, alert_work wouldn't be cancelled.

Could this result in a use-after-free when the delayed timer fires, or a
NULL pointer dereference if the work executes and calls lm90_update_alarms()
before data->hwmon_dev is assigned?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1