Re: [PATCH v4 11/12] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The embedded kobject in `struct ioatdma_chan` lacks a `.release` method, decoupling its lifecycle from the containing object and creating a potential use-after-free via sysfs.
--

--- Patch [11]: [PATCH v4 11/12] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show() ---
commit af292acf66777b7c34a85fccbbbae1f36425b555
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()

Convert the sprintf() calls in the per-channel sysfs attribute show()
functions to sysfs_emit().

> diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c
> index e796ddb5383f8..976134df81084 100644
> --- a/drivers/dma/ioat/sysfs.c
> +++ b/drivers/dma/ioat/sysfs.c
[ ... ]
> @@ -135,7 +135,7 @@ static ssize_t intr_coalesce_show(struct dma_chan *c, char *page)
>  {
>  	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
>  
> -	return sprintf(page, "%d\n", ioat_chan->intr_coalesce);
> +	return sysfs_emit(page, "%d\n", ioat_chan->intr_coalesce);
>  }
>  
>  static ssize_t intr_coalesce_store(struct dma_chan *c, const char *page,

[Severity: High]
This is a pre-existing issue, but since we are modifying sysfs behavior here,
does the embedded kobject in struct ioatdma_chan lack a proper lifecycle?

Looking at ioat_ktype further down in this file, it does not define a release
callback:

const struct kobj_type ioat_ktype = {
	.sysfs_ops = &ioat_sysfs_ops,
	.default_groups = ioat_groups,
};

If a sysfs file is kept open by a userspace process and the driver is unbound,
release_ioatdma() unconditionally frees the channel:

drivers/dma/ioat/init.c:release_ioatdma() {
    ...
	for (i = 0; i < IOAT_MAX_CHANS; i++)
		kfree(d->idx[i]);
    ...
}

Could this result in a use-after-free when the userspace process eventually
closes the file descriptor, dropping the kernfs reference and causing
kobject_put() to dereference the freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728171523.112244-1-logang@deltatee.com?part=11