Re: [PATCH] dmaengine: qcom: gpi: convert to subsys_platform_driver()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] dmaengine: qcom: gpi: UAF on module unload without .remove
  teardown
--

commit 022d58249a5185506a5361f23cc1e72841878880
Author: Brian Masney <bmasney@redhat.com>

dmaengine: qcom: gpi: convert to subsys_platform_driver()

This commit replaces the manual gpi_init() and subsys_initcall() registration
with subsys_platform_driver(gpi_driver), which also adds a module_exit()
handler that calls platform_driver_unregister().

> diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
> index c41bfac65ddf3..d6c76ce1846e2 100644
> --- a/drivers/dma/qcom/gpi.c
> +++ b/drivers/dma/qcom/gpi.c
> @@ -2325,11 +2325,7 @@ static struct platform_driver gpi_driver = {
>  	},
>  };
>  
> -static int __init gpi_init(void)
> -{
> -	return platform_driver_register(&gpi_driver);
> -}
> -subsys_initcall(gpi_init)
> +subsys_platform_driver(gpi_driver);

[Severity: High]
Can unloading the module now cause a use-after-free on gpi_dev and unmapped
module text?

Previously the module had a module_init() without a module_exit(), so
delete_module() refused to unload it with -EBUSY.  subsys_platform_driver()
adds a module_exit() callback that runs platform_driver_unregister(&gpi_driver).

gpi_probe() allocates gpi_dev with devm_kzalloc() and registers it through the
unmanaged dma_async_device_register() and of_dma_controller_register() APIs,
while gpi_driver defines no .remove callback.  When the module is unloaded,
devres frees gpi_dev and the module text is unmapped, leaving &gpi_dev->dma_device
and gpi_of_dma_xlate registered in the global DMA engine and OF DMA controller
lists; any subsequent DMA channel lookup or sysfs access then dereferences freed
memory and unmapped code.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-dma-gpi-subsys-v1-1-b37dcb4ba3c4@redhat.com?part=1