[PATCH] dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

[PATCH] dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

[Hungyu Lin]

Replace sprintf() and strlen() patterns in sysfs show callbacks
with sysfs_emit().

sysfs_emit() is the preferred helper for formatting sysfs output
and simplifies the implementation.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/dma/qcom/hidma.c          |  6 ++----
 drivers/dma/qcom/hidma_mgmt_sys.c | 19 ++++++++-----------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index 5a8dca8db5ce..7a7f302a9699 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -624,12 +624,10 @@ static ssize_t hidma_show_values(struct device *dev,
 {
 	struct hidma_dev *mdev = dev_get_drvdata(dev);
 
-	buf[0] = 0;
-
 	if (strcmp(attr->attr.name, "chid") == 0)
-		sprintf(buf, "%d\n", mdev->chidx);
+		return sysfs_emit(buf, "%d\n", mdev->chidx);
 
-	return strlen(buf);
+	return 0;
 }
 
 static inline void  hidma_sysfs_uninit(struct hidma_dev *dev)
diff --git a/drivers/dma/qcom/hidma_mgmt_sys.c b/drivers/dma/qcom/hidma_mgmt_sys.c
index 930eae0a6257..9672ef9ee8fc 100644
--- a/drivers/dma/qcom/hidma_mgmt_sys.c
+++ b/drivers/dma/qcom/hidma_mgmt_sys.c
@@ -102,15 +102,12 @@ static ssize_t show_values(struct device *dev, struct device_attribute *attr,
 	struct hidma_mgmt_dev *mdev = dev_get_drvdata(dev);
 	unsigned int i;
 
-	buf[0] = 0;
-
 	for (i = 0; i < ARRAY_SIZE(hidma_mgmt_files); i++) {
-		if (strcmp(attr->attr.name, hidma_mgmt_files[i].name) == 0) {
-			sprintf(buf, "%d\n", hidma_mgmt_files[i].get(mdev));
-			break;
-		}
+		if (strcmp(attr->attr.name, hidma_mgmt_files[i].name) == 0)
+			return sysfs_emit(buf, "%d\n",
+					hidma_mgmt_files[i].get(mdev));
 	}
-	return strlen(buf);
+	return 0;
 }
 
 static ssize_t set_values(struct device *dev, struct device_attribute *attr,
@@ -143,15 +140,15 @@ static ssize_t show_values_channel(struct kobject *kobj,
 	struct hidma_chan_attr *chattr;
 	struct hidma_mgmt_dev *mdev;
 
-	buf[0] = 0;
 	chattr = container_of(attr, struct hidma_chan_attr, attr);
 	mdev = chattr->mdev;
+
 	if (strcmp(attr->attr.name, "priority") == 0)
-		sprintf(buf, "%d\n", mdev->priority[chattr->index]);
+		return sysfs_emit(buf, "%d\n", mdev->priority[chattr->index]);
 	else if (strcmp(attr->attr.name, "weight") == 0)
-		sprintf(buf, "%d\n", mdev->weight[chattr->index]);
+		return sysfs_emit(buf, "%d\n", mdev->weight[chattr->index]);
 
-	return strlen(buf);
+	return 0;
 }
 
 static ssize_t set_values_channel(struct kobject *kobj,
-- 
2.34.1

Re: [PATCH] dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing kobject_put on error paths and driver removal leaves dangling sysfs files, leading to Use-After-Free when accessed.
--

commit fad7d7a1746d0d84aca95c02e2a6fd4400ce44f9
Author: Hungyu Lin <dennylin0707@gmail.com>

dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

This commit replaces sprintf() and strlen() patterns in the sysfs show
callbacks of the hidma driver with the preferred sysfs_emit() helper.

> diff --git a/drivers/dma/qcom/hidma_mgmt_sys.c b/drivers/dma/qcom/hidma_mgmt_sys.c
> index 930eae0a6257c..9672ef9ee8fc0 100644
> --- a/drivers/dma/qcom/hidma_mgmt_sys.c
> +++ b/drivers/dma/qcom/hidma_mgmt_sys.c

[ ... ]

> @@ -143,15 +140,15 @@ static ssize_t show_values_channel(struct kobject *kobj,
>  	struct hidma_chan_attr *chattr;
>  	struct hidma_mgmt_dev *mdev;
>  
> -	buf[0] = 0;
>  	chattr = container_of(attr, struct hidma_chan_attr, attr);
>  	mdev = chattr->mdev;

[Severity: Critical]
This is a pre-existing issue, but while reviewing these sysfs callbacks,
could there be a use-after-free triggered here when mdev or chattr are
accessed?

Looking at hidma_mgmt_init_sys(), kobjects are created in loops:

	chanops = kobject_create_and_add("chanops", &mdev->pdev->dev.kobj);

However, there do not appear to be any matching kobject_put() calls on the
error paths, nor a remove callback to tear them down on driver unbind. Since
the structures backing these attributes (mdev and chattr) are managed by
devm_ allocations, they are automatically freed upon probe failure or device
unbind.

Does this allow the sysfs files to remain accessible in the filesystem,
triggering a use-after-free when reading or writing to them dereferences
the freed memory in show_values_channel()?

> +
>  	if (strcmp(attr->attr.name, "priority") == 0)
> -		sprintf(buf, "%d\n", mdev->priority[chattr->index]);
> +		return sysfs_emit(buf, "%d\n", mdev->priority[chattr->index]);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260607163119.78717-1-dennylin0707@gmail.com?part=1

Re: [PATCH] dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

[Dmitry Baryshkov]

On Sun, Jun 07, 2026 at 04:31:19PM +0000, Hungyu Lin wrote:
> Replace sprintf() and strlen() patterns in sysfs show callbacks
> with sysfs_emit().
> 
> sysfs_emit() is the preferred helper for formatting sysfs output
> and simplifies the implementation.
> 
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  drivers/dma/qcom/hidma.c          |  6 ++----
>  drivers/dma/qcom/hidma_mgmt_sys.c | 19 ++++++++-----------
>  2 files changed, 10 insertions(+), 15 deletions(-)
> 

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>


-- 
With best wishes
Dmitry