Re: [PATCH v2 4/6] iio: humidity: hid-sensor-humidity: use common device for devres

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Switching devres allocation for `humid_chans` from `&indio_dev->dev` to `&pdev->dev` breaks the IIO object lifetime model, introducing a Use-After-Free (UAF) vulnerability when the IIO device outlives the platform device.
--

commit 2c7cc72d2b1a34bface667809d68f3aaec43f667
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: humidity: hid-sensor-humidity: use common device for devres

This commit changes the devres allocation for the humidity channels to use
the platform device instead of the IIO device. The goal is to consolidate
devres ownership under a single parent device.

> diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
> index 8dd8bc0b3ba18..b7130eac03945 100644
> --- a/drivers/iio/humidity/hid-sensor-humidity.c
> +++ b/drivers/iio/humidity/hid-sensor-humidity.c
> @@ -216,7 +216,7 @@ static int hid_humidity_probe(struct platform_device *pdev)
>  	if (ret)
>  		return ret;
>  
> -	humid_chans = devm_kmemdup(&indio_dev->dev, humidity_channels,
> +	humid_chans = devm_kmemdup(&pdev->dev, humidity_channels,

[Severity: High]
Does this change introduce a regression if the IIO device outlives the
platform device?

If an in-kernel consumer obtains a channel reference via iio_channel_get(),
it increments the reference count of the IIO device (indio_dev->dev). This
allows indio_dev to outlive the platform device.

When the platform device is unbound, the devres framework will free
humid_chans because its lifetime is now tied to &pdev->dev. However, the
consumer will still hold an iio_channel structure where chan->channel points
into the now-freed humid_chans array.

If the consumer later calls APIs like iio_read_channel_ext_info(), could this
dereference chan->channel->ext_info and access freed memory?

>  				   sizeof(humidity_channels), GFP_KERNEL);
>  	if (!humid_chans)
>  		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-15-jun-hid-iio-alignment-v2-0-b87f01f5efbc@gmail.com?part=4