Re: [PATCH v2 6/6] iio: temperature: hid-sensor-temperature: use common device for devres

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Changing the devm_kmemdup() parent from `&indio_dev->dev` to `&pdev->dev` introduces a Use-After-Free vulnerability by violating the IIO device lifetime model.
--

commit f64b0b02100e325f644f897f84be1fbd188c0d40
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: temperature: hid-sensor-temperature: use common device for devres

This commit changes the device used for devm_kmemdup() from the IIO device
to the platform device. This aims to consolidate devres ownership under a
single parent device.

> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
> index 18da85e6c60ed..6dfb606a53af3 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c
> @@ -213,8 +213,8 @@ static int hid_temperature_probe(struct platform_device *pdev)
>  	if (ret)
>  		return ret;
>  
> -	temp_chans = devm_kmemdup(&indio_dev->dev, temperature_channels,
> -				sizeof(temperature_channels), GFP_KERNEL);
> +	temp_chans = devm_kmemdup(&pdev->dev, temperature_channels,
> +				  sizeof(temperature_channels), GFP_KERNEL);

[Severity: High]
Could tying the channel array allocated here in hid_temperature_probe() to
the platform device's devres introduce a use-after-free regression if an
in-kernel consumer holds a reference to the IIO device?

If an in-kernel IIO consumer, such as iio_hwmon, acquires a reference to a
channel of this device via iio_channel_get(), the reference count of the
logical IIO device (indio_dev) is incremented.

When the platform device (pdev) is unbound, the devres cleanup for pdev will
run and free the temp_chans array because its parent is now pdev->dev. The
devres cleanup then calls iio_device_unregister(), which drops the driver's
reference to indio_dev, but indio_dev itself remains alive due to the
consumer's reference.

If the consumer subsequently calls an IIO API like iio_read_channel_label()
or iio_get_channel_ext_info_count(), can these APIs directly dereference the
channel pointers into the freed temp_chans array without checking if the
device is unregistered?

Should the temp_chans array remain tied to &indio_dev->dev to ensure its
lifetime safely extends until the IIO device itself is fully released?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-15-jun-hid-iio-alignment-v2-0-b87f01f5efbc@gmail.com?part=6