Re: [PATCH v9 15/17] iio: frequency: ad9910: show channel priority in debugfs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Lockless access to `indio_dev->active_scan_mask` in debugfs callbacks leads to a Time-of-Check to Time-of-Use (TOCTOU) Use-After-Free or NULL pointer dereference.
--

--- Patch [15]: [PATCH v9 15/17] iio: frequency: ad9910: show channel priority in debugfs ---
commit fd59307766b0ba216861518edba7f7cf6e5c6e92
Author: Rodrigo Alencar <rodrigo.alencar@analog.com>

iio: frequency: ad9910: show channel priority in debugfs

This commit exposes frequency, phase, and amplitude source attributes in
debugfs for the AD9910 driver. These attributes indicate which channel
is sourcing specific DDS parameters based on the device's priority table.

> diff --git a/drivers/iio/frequency/ad9910.c b/drivers/iio/frequency/ad9910.c
> index 49a70909bf5fe..32bd1e6cf14f7 100644
> --- a/drivers/iio/frequency/ad9910.c
> +++ b/drivers/iio/frequency/ad9910.c

[ ... ]

> +static inline const char *ad9910_frequency_source_get(struct iio_dev *indio_dev)
> +{
> +	struct ad9910_state *st = iio_priv(indio_dev);
> +	bool ram_en, mode_en;
> +
> +	guard(mutex)(&st->lock);
> +

[ ... ]

> +	/* Parallel data port enabled and data destination is frequency */
> +	mode_en = FIELD_GET(AD9910_CFR2_PARALLEL_DATA_PORT_EN_MSK,
> +			    st->reg[AD9910_REG_CFR2].val32);
> +	if (mode_en && indio_dev->active_scan_mask &&
> +	    test_bit(AD9910_SCAN_IDX_FREQ, indio_dev->active_scan_mask))
                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Severity: Medium]
Is it safe to access indio_dev->active_scan_mask here without holding the
IIO core mlock?

If another thread concurrently disables buffers, could the mask be freed and
set to NULL between the if check and test_bit(), leading to a NULL pointer
dereference?

While this appears to be a latent regression since the driver currently only
sets INDIO_DIRECT_MODE, could this cause crashes if buffer support is added in
the future?

> +		return ad9910_channel_str[AD9910_CHAN_IDX_PARALLEL_FREQ];

[ ... ]

> +static inline const char *ad9910_phase_source_get(struct iio_dev *indio_dev)
> +{
> +	struct ad9910_state *st = iio_priv(indio_dev);
> +	bool ram_en, mode_en;
> +	u32 destination;
> +
> +	guard(mutex)(&st->lock);
> +

[ ... ]

> +	/* Parallel data port enabled and data destination is phase */
> +	mode_en = FIELD_GET(AD9910_CFR2_PARALLEL_DATA_PORT_EN_MSK,
> +			    st->reg[AD9910_REG_CFR2].val32);
> +	if (mode_en && indio_dev->active_scan_mask) {
> +		if (test_bit(AD9910_SCAN_IDX_PHASE, indio_dev->active_scan_mask))
                                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Severity: Medium]
Could this also be affected by the same lockless access issue with
indio_dev->active_scan_mask mentioned above?

> +			return ad9910_channel_str[AD9910_CHAN_IDX_PARALLEL_PHASE];
> +		if (test_bit(AD9910_SCAN_IDX_POLAR_PHASE, indio_dev->active_scan_mask))
> +			return ad9910_channel_str[AD9910_CHAN_IDX_PARALLEL_POLAR_PHASE];
> +	}

[ ... ]

> +static inline const char *ad9910_amplitude_source_get(struct iio_dev *indio_dev)
> +{
> +	struct ad9910_state *st = iio_priv(indio_dev);
> +	bool ram_en, mode_en;
> +	u32 destination;
> +
> +	guard(mutex)(&st->lock);
> +

[ ... ]

> +	/* Parallel data port enabled and data destination is amplitude */
> +	mode_en = FIELD_GET(AD9910_CFR2_PARALLEL_DATA_PORT_EN_MSK,
> +			    st->reg[AD9910_REG_CFR2].val32);
> +	if (mode_en && indio_dev->active_scan_mask) {
> +		if (test_bit(AD9910_SCAN_IDX_AMP, indio_dev->active_scan_mask))
                                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^
[Severity: Medium]
Does this also have the same lockless access issue with
indio_dev->active_scan_mask?

> +			return ad9910_channel_str[AD9910_CHAN_IDX_PARALLEL_AMP];
> +		if (test_bit(AD9910_SCAN_IDX_POLAR_AMP, indio_dev->active_scan_mask))
> +			return ad9910_channel_str[AD9910_CHAN_IDX_PARALLEL_POLAR_AMP];
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-ad9910-iio-driver-v9-0-459d1df5ac56@analog.com?part=15