Re: [PATCH] dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing kobject_put on error paths and driver removal leaves dangling sysfs files, leading to Use-After-Free when accessed.
--

commit fad7d7a1746d0d84aca95c02e2a6fd4400ce44f9
Author: Hungyu Lin <dennylin0707@gmail.com>

dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks

This commit replaces sprintf() and strlen() patterns in the sysfs show
callbacks of the hidma driver with the preferred sysfs_emit() helper.

> diff --git a/drivers/dma/qcom/hidma_mgmt_sys.c b/drivers/dma/qcom/hidma_mgmt_sys.c
> index 930eae0a6257c..9672ef9ee8fc0 100644
> --- a/drivers/dma/qcom/hidma_mgmt_sys.c
> +++ b/drivers/dma/qcom/hidma_mgmt_sys.c

[ ... ]

> @@ -143,15 +140,15 @@ static ssize_t show_values_channel(struct kobject *kobj,
>  	struct hidma_chan_attr *chattr;
>  	struct hidma_mgmt_dev *mdev;
>  
> -	buf[0] = 0;
>  	chattr = container_of(attr, struct hidma_chan_attr, attr);
>  	mdev = chattr->mdev;

[Severity: Critical]
This is a pre-existing issue, but while reviewing these sysfs callbacks,
could there be a use-after-free triggered here when mdev or chattr are
accessed?

Looking at hidma_mgmt_init_sys(), kobjects are created in loops:

	chanops = kobject_create_and_add("chanops", &mdev->pdev->dev.kobj);

However, there do not appear to be any matching kobject_put() calls on the
error paths, nor a remove callback to tear them down on driver unbind. Since
the structures backing these attributes (mdev and chattr) are managed by
devm_ allocations, they are automatically freed upon probe failure or device
unbind.

Does this allow the sysfs files to remain accessible in the filesystem,
triggering a use-after-free when reading or writing to them dereferences
the freed memory in show_values_channel()?

> +
>  	if (strcmp(attr->attr.name, "priority") == 0)
> -		sprintf(buf, "%d\n", mdev->priority[chattr->index]);
> +		return sysfs_emit(buf, "%d\n", mdev->priority[chattr->index]);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260607163119.78717-1-dennylin0707@gmail.com?part=1