Re: [PATCH v1 5/6] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `.release` callback in `ioat_ktype` leads to Use-After-Free during device teardown.
--

--- Patch [5]: [PATCH v1 5/6] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show() ---
commit 92c0d5a2427ebf1a54399ad0e602ee20f0d12130
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()

Convert the sprintf() calls in the per-channel sysfs attribute show()
functions to sysfs_emit().

> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
> index e796ddb5383f8..976134df81084 100644
> --- a/drivers/dma/ioat/sysfs.c
> +++ b/drivers/dma/ioat/sysfs.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but does ioat_ktype need a .release callback?

Looking at drivers/dma/ioat/sysfs.c:ioat_ktype:

const struct kobj_type ioat_ktype = {
	.sysfs_ops = &ioat_sysfs_ops,
	.default_groups = ioat_groups,
};

Without a .release callback, doesn't this break the kobject reference counting
lifecycle?  If a user space process keeps a sysfs file open (like ring_size)
while the device is hot-unplugged or the driver is unbound, release_ioatdma()
frees the ioatdma_chan structures directly.

When the user space process later closes the sysfs file and the kobject
reference count drops to zero, the kernel will attempt to access the kobject
embedded in the already-freed ioatdma_chan memory.  Can this cause a
use-after-free during device teardown?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717221001.361421-1-logang@deltatee.com?part=5