Re: [PATCH v3 7/9] iio: humidity: hid-sensor-humidity: use common device for devres

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free due to lifetime mismatch between IIO device and platform device devres
--

commit 2edcf899b7cb430d80f56a0ef1506dd20ea46d9d
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: humidity: hid-sensor-humidity: use common device for devres

This commit changes the devres allocation of humidity channels to use the
platform device instead of the IIO device. The goal is to have a single,
well-defined parent device for devres ownership.

> diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
> --- a/drivers/iio/humidity/hid-sensor-humidity.c
> +++ b/drivers/iio/humidity/hid-sensor-humidity.c
> @@ -215,7 +215,7 @@ static int hid_humidity_probe(struct platform_device *pdev)
>  	if (ret)
>  		return ret;
>  
> -	humid_chans = devm_kmemdup(&indio_dev->dev, humidity_channels,
> +	humid_chans = devm_kmemdup(&pdev->dev, humidity_channels,
>  				   sizeof(humidity_channels), GFP_KERNEL);

Could this change introduce a use-after-free if the IIO device outlives the
driver binding?

The indio_dev object is allocated using devm_iio_device_alloc(), meaning it is
reference-counted and its lifetime can exceed the platform device binding if
consumers hold a reference.

If the driver unbinds, the pdev devres callbacks will execute and free the
humid_chans memory. However, indio_dev->channels still points to this freed
array.

If a consumer later calls IIO APIs like iio_read_channel_ext_info(), they
will dereference the freed humid_chans memory.

>  	if (!humid_chans)
>  		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260509101040.791404-1-sanjayembedded@gmail.com?part=7