Re: [PATCH v6 2/9] platform/x86: dell-privacy: Use new buffer-based WMI API

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] dell_privacy_has_mic_mute() accesses `priv->features_present` after releasing `list_mutex`, risking a Use-After-Free if the device is concurrently unbound.
--

commit c9150394b4cc5e06aab976ccc95fd348e2c66514
Author: Armin Wolf <W_Armin@gmx.de>

platform/x86: dell-privacy: Use new buffer-based WMI API

Use the new buffer-based WMI API to also support ACPI firmware
implementations that do not use ACPI buffers for the device state.

> diff --git a/drivers/platform/x86/dell/dell-wmi-privacy.c b/drivers/platform/x86/dell/dell-wmi-privacy.c
> index ed099a431ea4d..f9d275b2f900c 100644
> --- a/drivers/platform/x86/dell/dell-wmi-privacy.c
> +++ b/drivers/platform/x86/dell/dell-wmi-privacy.c
[ ... ]
> @@ -185,60 +208,28 @@ static struct attribute *privacy_attrs[] = {
>  };
>  ATTRIBUTE_GROUPS(privacy);
>  

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the file
I noticed a potential use-after-free in dell_privacy_has_mic_mute().

dell_privacy_has_mic_mute() accesses priv->features_present after
releasing list_mutex:

bool dell_privacy_has_mic_mute(void)
{
	struct privacy_wmi_data *priv;

	mutex_lock(&list_mutex);
	priv = list_first_entry_or_null(&wmi_list,
			struct privacy_wmi_data,
			list);
	mutex_unlock(&list_mutex);

	return priv && (priv->features_present & BIT(DELL_PRIVACY_TYPE_AUDIO));
}

If dell_privacy_wmi_remove() executes concurrently (e.g., via sysfs unbind)
and removes priv from the list, the devres core will automatically free the
devm_kzalloc-backed priv structure.

If the thread running dell_privacy_has_mic_mute() is preempted immediately
after unlocking list_mutex, will the subsequent dereference of
priv->features_present read freed memory?

> -/*
> - * Describes the Device State class exposed by BIOS which can be consumed by
> - * various applications interested in knowing the Privacy feature capabilities.
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610203453.816254-1-W_Armin@gmx.de?part=2