Re: [PATCH v3 1/1] hwmon: (applesmc) Convert to hwmon_device_register_with_info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Mixing devres-managed memory allocations with a non-devres hwmon device registration creates a lifetime mismatch leading to a Use-After-Free when the driver is unbound via sysfs.
--

--- Patch [1]: [PATCH v3 1/1] hwmon: (applesmc) Convert to hwmon_device_register_with_info ---
commit cc16bf8a12a2f101dd9a6c6d676340d91b9c4973
Author: Shih-Yuan Lee <fourdollars@debian.org>

hwmon: (applesmc) Convert to hwmon_device_register_with_info

The legacy hwmon_device_register() function is deprecated and triggers a
warning in dmesg during driver initialization. Convert the driver to use
the modern hwmon_device_register_with_info() API, moving standard
attributes to the HWMON core and dynamically allocating extra groups.

> diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
> --- a/drivers/hwmon/applesmc.c
> +++ b/drivers/hwmon/applesmc.c
> @@ -1343,17 +1434,97 @@ static int __init applesmc_init(void)

[ ... ]

> +	/* Create non-standard fanX_safe attributes group */
> +	fan_safe_attrs = devm_kcalloc(&pdev->dev, smcreg.fan_count,
> +				      sizeof(*fan_safe_attrs), GFP_KERNEL);
> +	fan_safe_attr_list = devm_kcalloc(&pdev->dev, smcreg.fan_count + 1,
> +					  sizeof(*fan_safe_attr_list), GFP_KERNEL);

[ ... ]

> -	hwmon_dev = hwmon_device_register(&pdev->dev);
> +	hwmon_dev = hwmon_device_register_with_info(&pdev->dev, "applesmc", NULL,
> +						    chip, applesmc_extra_groups);

[Severity: High]
Does mixing devres-managed memory allocations with a non-devres hwmon device
registration create a lifetime mismatch?

If a privileged user unbinds the applesmc driver via sysfs, the device core
detaches the driver and releases all devres-managed allocations tied to
pdev->dev, including the fan_safe_attrs array.

However, the hwmon device remains registered because it was created with the
non-managed hwmon_device_register_with_info() in applesmc_init() and is only
unregistered during module removal.

Since the active hwmon sysfs files still reference the freed fan_safe_attrs,
could a subsequent read of a file like fan1_safe dereference a function
pointer in freed memory and lead to a use-after-free? Should this be using
devm_hwmon_device_register_with_info() instead to tie the hwmon device
lifetime to the device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260711053915.4834-2-fourdollars@debian.org?part=1