Re: [PATCH v5 04/13] iio: gyro: hid-sensor-gyro-3d: convert probe and teardown to devm-managed resources

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Preexisting UAF race between HID sensor event delivery and device unbinding.
--

--- Patch [4]: [PATCH v5 04/13] iio: gyro: hid-sensor-gyro-3d: convert probe and teardown to devm-managed resources ---
Note: The format of this report is altered due to recitation restrictions. The original patch diff is not quoted.

commit 0412f8ea67eb98e8cb4da48580ccc04772e8482a
Author: Sanjay Chitroda <[email protected]>

iio: gyro: hid-sensor-gyro-3d: convert probe and teardown to devm-managed resources

Convert HID IIO driver resource management to use devm-managed helpers,
tying the lifetime of all resources to the device. This simplifies the
probe path by removing goto-based error handling and eliminates the
remove callback entirely.

[Severity: High]
This is a pre-existing issue, but I noticed a potential Use-After-Free race
between HID sensor event delivery and device unbinding that could be exposed
here.

In drivers/hid/hid-sensor-hub.c:sensor_hub_remove_callback(), the callback
is removed from the list while holding dyn_callback_lock, but the function
returns immediately without synchronizing with or waiting for concurrent
readers to finish.

If a concurrent event is being processed in sensor_hub_raw_event(), it drops
dyn_callback_lock before invoking callback->capture_sample and accessing
callback->pdev.

During device unbind, the devres cleanup for the newly introduced
devm_sensor_hub_register_callback() will remove the callback. Immediately
after, the devres cleanup for devm_iio_device_alloc() frees indio_dev,
which contains the gyro_state->callbacks structure.

If sensor_hub_raw_event() is executing concurrently with an unbind (for
example, via sysfs), could it dereference the freed callback pointer to call
callback->capture_sample, leading to a Use-After-Free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-28-apr-iio-redundant-argument-v5-temp-v5-0-f1f92c1d830f@gmail.com?part=4