Re: [PATCH v5 01/13] iio: hid-sensors: remove unused iio_dev argument

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Concurrent execution of `sensor_hub_raw_event` and a child IIO driver's `remove` function can cause a Use-After-Free on the IIO device state.
--

--- Patch [1]: [PATCH v5 01/13] iio: hid-sensors: remove unused iio_dev argument ---
commit c12a28d854a2931313f7d217face266eaf20a33a
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: hid-sensors: remove unused iio_dev argument

hid_sensor_remove_trigger() no longer uses the iio_dev argument. Remove the
unused argument from all HID IIO drivers to match updated function prototype.

> diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
> --- a/drivers/iio/accel/hid-sensor-accel-3d.c
> +++ b/drivers/iio/accel/hid-sensor-accel-3d.c
[ ... ]
> @@ -415,7 +415,7 @@ static void hid_accel_3d_remove(struct platform_device *pdev)
>  
>  	iio_device_unregister(indio_dev);
>  	sensor_hub_remove_callback(hsdev, hsdev->usage);

[Severity: High]
This isn't a bug introduced by this patch, but does the concurrent execution
of sensor_hub_raw_event() and this remove() function cause a use-after-free
on the IIO device state?

Looking at sensor_hub_remove_callback() in drivers/hid/hid-sensor-hub.c, it
removes the callback using dyn_callback_lock but does not synchronize with
pdata->lock:

drivers/hid/hid-sensor-hub.c:sensor_hub_remove_callback() {
    spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
    // list removal
    spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
}

If an unbind happens concurrently with an incoming hardware event:

CPU1
sensor_hub_raw_event()
    acquires pdata->lock
    finds registered callback

CPU2
hid_accel_3d_remove()
    sensor_hub_remove_callback()
        removes callback and returns
    devres framework frees the IIO device state

CPU1
sensor_hub_raw_event()
    if (callback->capture_sample) {
        callback->capture_sample(...) // Dereferences freed IIO state

Can this lead to memory corruption during physical device removal or sysfs
unbind?

> -	hid_sensor_remove_trigger(indio_dev, &accel_state->common_attributes);
> +	hid_sensor_remove_trigger(&accel_state->common_attributes);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-28-apr-iio-redundant-argument-v5-temp-v5-0-f1f92c1d830f@gmail.com?part=1