Re: [PATCH v5 12/13] iio: position: hid-sensor-custom-intel-hinge: convert probe and teardown to devm-managed resources

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but there is a possible Use-After-Free (UAF) during driver unbind or probe error due to missing synchronization with concurrent hardware events.
--

--- Patch [12]: [PATCH v5 12/13] iio: position: hid-sensor-custom-intel-hinge: convert probe and teardown to devm-managed resources ---
commit 9db33d404c2c76bf6835ddae77ee4ee1c86c8f21
Author: Sanjay Chitroda <[email protected]>

iio: position: hid-sensor-custom-intel-hinge: convert probe and teardown to devm-managed resources

This patch converts the HID IIO driver resource management to use
devm-managed helpers, tying the lifetime of resources to the device.
It simplifies the probe path by removing explicit error handling and
eliminates the remove callback.

> diff --git a/drivers/iio/position/hid-sensor-custom-intel-hinge.c b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
> index 7f6186fea0047..101d84b533c9e 100644
> --- a/drivers/iio/position/hid-sensor-custom-intel-hinge.c
> +++ b/drivers/iio/position/hid-sensor-custom-intel-hinge.c

[ ... ]

> @@ -320,37 +321,13 @@ static int hid_hinge_probe(struct platform_device *pdev)
>  	st->callbacks.send_event = hinge_proc_event;
>  	st->callbacks.capture_sample = hinge_capture_sample;
>  	st->callbacks.pdev = pdev;
> -	ret = sensor_hub_register_callback(hsdev, hsdev->usage, &st->callbacks);
> +	ret = devm_sensor_hub_register_callback(dev, hsdev, hsdev->usage, &st->callbacks);

[Severity: High]
This is a pre-existing issue, but can this sequence lead to a write-after-free
if a hardware event races with driver unbind or probe error?

During devm cleanup, sensor_hub_remove_callback() removes the callback from
the list without waiting for concurrent readers. The cleanup then immediately
frees the hinge_state structure allocated earlier.

If a concurrent HID hardware event triggers sensor_hub_raw_event(), can it
fetch the callback and execute hinge_capture_sample() after the structure
has been freed:

drivers/iio/position/hid-sensor-custom-intel-hinge.c:hinge_capture_sample() {
    ...
    st->scan.hinge_val[offset] = *(u32 *)raw_data;
    ...
}

Should there be synchronization to ensure concurrent hardware events have
completed before the memory backing the callback is freed?

>  	if (ret < 0) {
>  		dev_err(&pdev->dev, "callback reg failed\n");
> -		goto error_remove_trigger;
> -	}
> -
> -	ret = iio_device_register(indio_dev);
> -	if (ret) {
> -		dev_err(&pdev->dev, "device register failed\n");
> -		goto error_remove_callback;
> +		return ret;
>  	}
>  
> -	return ret;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-28-apr-iio-redundant-argument-v5-temp-v5-0-f1f92c1d830f@gmail.com?part=12