Re: [PATCH 3/3] iio: light: stk3310: support the Sensortek STK36C61

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The IIO device is unregistered before the threaded IRQ handler is freed, creating a Use-After-Free race condition during device removal.
--

--- Patch [3]: [PATCH 3/3] iio: light: stk3310: support the Sensortek STK36C61 ---
commit c621ace8607632002893d3b296ea6bb5b3e8c5f1
Author: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>

iio: light: stk3310: support the Sensortek STK36C61

This commit adds support for the Sensortek STK36C61 ambient light,
proximity, and RGB color sensor to the stk3310 driver. It introduces the
new chip ID, registers, and intensity channels for color data.

> diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c
> index 17b1ff42bf6e1..289900aeafa78 100644
> --- a/drivers/iio/light/stk3310.c
> +++ b/drivers/iio/light/stk3310.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential
use-after-free race during device removal in this driver.

In stk3310_remove(), the IIO device is unregistered before the devm-managed
threaded IRQ handler is freed:

drivers/iio/light/stk3310.c:stk3310_remove() {
	struct iio_dev *indio_dev = i2c_get_clientdata(client);

	iio_device_unregister(indio_dev);
	stk3310_set_state(iio_priv(indio_dev), STK3310_STATE_STANDBY);
}

Since the interrupt is requested with devm_request_threaded_irq() in
stk3310_probe(), it remains active until after stk3310_remove() returns.

If an interrupt fires during or immediately after iio_device_unregister(),
the IRQ handler can call iio_push_event().

Because iio_device_unregister() frees the event interface, could this result
in a use-after-free when the active IRQ handler writes to the freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260810110423.41697-1-jorijnvdgraaf@catcrafts.net?part=3