[PATCH] dmaengine: qcom: gpi: convert to subsys_platform_driver()

[PATCH] dmaengine: qcom: gpi: convert to subsys_platform_driver()

[Brian Masney]

Reduce boilerplate code in this driver and convert it over to use
the macro subsys_platform_driver().

Note that this driver is configured in the Kconfig to be a tristate,
the driver doesn't have suppress_bind_attrs set, and there is no __exit
function defined. This change will add an __exit function that
unregisters the platform driver.

Signed-off-by: Brian Masney <bmasney@redhat.com>
---
 drivers/dma/qcom/gpi.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
index c41bfac65ddf..d6c76ce1846e 100644
--- a/drivers/dma/qcom/gpi.c
+++ b/drivers/dma/qcom/gpi.c
@@ -2325,11 +2325,7 @@ static struct platform_driver gpi_driver = {
 	},
 };
 
-static int __init gpi_init(void)
-{
-	return platform_driver_register(&gpi_driver);
-}
-subsys_initcall(gpi_init)
+subsys_platform_driver(gpi_driver);
 
 MODULE_DESCRIPTION("QCOM GPI DMA engine driver");
 MODULE_LICENSE("GPL v2");

---
base-commit: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
change-id: 20261106-dma-gpi-subsys-594acc21c25b

Best regards,
--  
Brian Masney <bmasney@redhat.com>

Re: [PATCH] dmaengine: qcom: gpi: convert to subsys_platform_driver()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] dmaengine: qcom: gpi: UAF on module unload without .remove
  teardown
--

commit 022d58249a5185506a5361f23cc1e72841878880
Author: Brian Masney <bmasney@redhat.com>

dmaengine: qcom: gpi: convert to subsys_platform_driver()

This commit replaces the manual gpi_init() and subsys_initcall() registration
with subsys_platform_driver(gpi_driver), which also adds a module_exit()
handler that calls platform_driver_unregister().

> diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
> index c41bfac65ddf3..d6c76ce1846e2 100644
> --- a/drivers/dma/qcom/gpi.c
> +++ b/drivers/dma/qcom/gpi.c
> @@ -2325,11 +2325,7 @@ static struct platform_driver gpi_driver = {
>  	},
>  };
>  
> -static int __init gpi_init(void)
> -{
> -	return platform_driver_register(&gpi_driver);
> -}
> -subsys_initcall(gpi_init)
> +subsys_platform_driver(gpi_driver);

[Severity: High]
Can unloading the module now cause a use-after-free on gpi_dev and unmapped
module text?

Previously the module had a module_init() without a module_exit(), so
delete_module() refused to unload it with -EBUSY.  subsys_platform_driver()
adds a module_exit() callback that runs platform_driver_unregister(&gpi_driver).

gpi_probe() allocates gpi_dev with devm_kzalloc() and registers it through the
unmanaged dma_async_device_register() and of_dma_controller_register() APIs,
while gpi_driver defines no .remove callback.  When the module is unloaded,
devres frees gpi_dev and the module text is unmapped, leaving &gpi_dev->dma_device
and gpi_of_dma_xlate registered in the global DMA engine and OF DMA controller
lists; any subsequent DMA channel lookup or sysfs access then dereferences freed
memory and unmapped code.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-dma-gpi-subsys-v1-1-b37dcb4ba3c4@redhat.com?part=1

Re: [PATCH] dmaengine: qcom: gpi: convert to subsys_platform_driver()

[Konrad Dybcio]

On 11/7/26 2:00 AM, Brian Masney wrote:
> Reduce boilerplate code in this driver and convert it over to use
> the macro subsys_platform_driver().
> 
> Note that this driver is configured in the Kconfig to be a tristate,
> the driver doesn't have suppress_bind_attrs set, and there is no __exit
> function defined. This change will add an __exit function that
> unregisters the platform driver.
> 
> Signed-off-by: Brian Masney <bmasney@redhat.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad