Re: [PATCH 09/10] iio: position: hid-sensor-custom-intel-hinge: use local struct device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Possible Use-After-Free of `hinge_state` and its embedded `callbacks` during driver unbind or probe error paths, due to lack of synchronization with concurrent HID sensor events.
--

--- Patch [9]: [PATCH 09/10] iio: position: hid-sensor-custom-intel-hinge: use local struct device ---
commit 7aa4981763773e6c94e52f6b3bcf4d8c0d85b050
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: position: hid-sensor-custom-intel-hinge: use local struct device

Introduce a local struct device pointer derived from pdev->dev to avoid
repeated pdev->dev usage and improve readability.

> diff --git a/drivers/iio/position/hid-sensor-custom-intel-hinge.c b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
> index d275bc1413feb..febc32f5a3328 100644
> --- a/drivers/iio/position/hid-sensor-custom-intel-hinge.c
> +++ b/drivers/iio/position/hid-sensor-custom-intel-hinge.c

[ ... ]

> @@ -322,13 +323,13 @@ static int hid_hinge_probe(struct platform_device *pdev)
>  	st->callbacks.pdev = pdev;
>  	ret = sensor_hub_register_callback(hsdev, hsdev->usage, &st->callbacks);
>  	if (ret < 0) {
> -		dev_err(&pdev->dev, "callback reg failed\n");
> +		dev_err(dev, "callback reg failed\n");
>  		goto error_remove_trigger;
>  	}
>  
>  	ret = iio_device_register(indio_dev);
>  	if (ret) {
> -		dev_err(&pdev->dev, "device register failed\n");
> +		dev_err(dev, "device register failed\n");
>  		goto error_remove_callback;
>  	}
>  
> 	return ret;
> 
> error_remove_callback:
> 	sensor_hub_remove_callback(hsdev, hsdev->usage);

[Severity: High]
This is a pre-existing issue, but can this lead to a use-after-free during
the probe error path or device unbind?

If iio_device_register() fails, sensor_hub_remove_callback() removes the
callback from the list but does not appear to synchronize with
sensor_hub_raw_event() which might be concurrently executing the callback.

Since the hinge_state structure is allocated with devm_iio_device_alloc(),
returning from hid_hinge_probe() will cause the devres framework to
prematurely free the memory while the concurrent event handler is actively
writing to it.

Does there need to be some synchronization to ensure pending events are
flushed before the devres cleanup occurs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-hid-iio-local-struct-device-v1-0-74496fee6327@gmail.com?part=9