From nobody Sat Feb 7 06:14:04 2026 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9201A33B6CC for ; Wed, 4 Feb 2026 20:34:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770237263; cv=none; b=RyBI86kd3ES589LJML9eZfusVnHUZnndA+b3/x8xLnsAO1e8QuERybv94fVjsr0uxte46H4vHevm/4L9A2+hzveUjnYUSVYI+s9Usri245H5UmlolRoPq3o/mSt+XWutq1Tctx7dKRkkpeogM9o8Of89ojP6Y2vF9O5BVRvysPw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770237263; c=relaxed/simple; bh=rvhVa3smICLx3UXNDdk4ydZcwdUWyxqatm62NxBVvZs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aVquukbLcFWICYeV304DQtQP1csgL9+pt3bR29IAUfHIHlxA/UpE01A4DFhtlFifD4StQK712F7pQtwXwFBgvRX+ORpqkzLsxvP0mkZ8Q7E3k1z6Ry8D65hWi7yemqvewiZPBwdG0qzleyU6mJYAe57QJBA9BoDtzwVjRPKkkYA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=C1AybAqI; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="C1AybAqI" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-4358fb60802so163149f8f.1 for ; Wed, 04 Feb 2026 12:34:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770237262; x=1770842062; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Zm6pQ0n8k0aUMJnRRXuxnSNa9+Aku/yu04RgcWOPpwg=; b=C1AybAqIB9ElnWPZBFVyWkNkrl8PPnahwzO53rSnNyg26cbtp496BDIH0LcXK7Sw+S JB+X/o9F9ShGR54j3ANB7/Mn9VfbJ2MiRDV/0zUDpsmiaJuFTmTxPG76nqJVPU8U8G2Y Bk5lmxq63qar3hb1v+IsmohVZT7m96q5z4H5UdYrJwFwE0iWisE6hronHpatLGpQWZ40 B05+uYxcry2a4cvj5Ja9C3/G/tOBacS5zvCsEzxBMGEq2IvXoQnMUyavtDAE63N3TL0b dxqA9LCeUvmEfv9GOEv5TSjw4HdGSh4ziXLFhQiXDsiJxVHTie5ArIx5+asXVNPJu8x4 pxXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770237262; x=1770842062; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Zm6pQ0n8k0aUMJnRRXuxnSNa9+Aku/yu04RgcWOPpwg=; b=hBJFOsO2w9XrgzNDzudqXa6zynTrTKQVjYhN/igRtfIm8AKfnrV9LO85iUfl7CWY4B e689/XyLXPcjUMv+TfAFKColAqwNc3ync9QIHsgVR1QHzhAt+ABtBvIrNVRwSkBXt1Kz A7OM4DFIvvtxLQJu3AcCZ77+MjARIlnXMUSEVSneJiuU9S88lgwsEpcyG43JzZIJmK2+ fV8bNfOJDqq/vYdUM7fnJrXwNAI6v83bJS6KhXpT9m9TCR9bU4vKX0SJRV4I7pR6X1C7 OYHcKeYFirwzuuUO6zsVHJNe4Lco87TkXvtznpQm2LWB2FsC2LIT+C9wOLBtur3VinKj nXdQ== X-Forwarded-Encrypted: i=1; AJvYcCULyE6rxx++AjOW7QPYfTanOKTJgPNWjlO7NTBk2puxw9dqjRc+Ya1dJ5+3iiercJ8LS7peoD4cSsXqipY=@vger.kernel.org X-Gm-Message-State: AOJu0Yyt8I5PH4AX2uK4VWdBOsgWFAOWBdCmlfJCbcL5ci6sXdtsTku7 FAhfjh1DO3wbRy/8S/AuOhLRcalQOmPvnbznLm8vKBIb1KkUR7auV2vl X-Gm-Gg: AZuq6aK00Oan6/am56eKZSBKNvABgAgPNRmiCxNtyy0Ipt5dQ3xGa/59lnuh97LnwR1 NDLgJdD8rYJOiVFwcW1SRaO3VLPuys2ru0iJP5JMPKpwDcqrG8TsDrr184teZ2DNChtIDi0GKFd GKK92DQuNVNuvswX2IT/JlIX15s15K6N0v+NISV6FyWlHRUYRJOqf/iYppOzae1obXGt++yJdzJ TXL1PcbCdC81VUwyRmlC2T8YDBHmYPZhtYBXS7mYUlHAlEEH82uPOPGk0w747suWRwxkKb8RZ9E bGs84bL6uehR84RKPQqY5LfvkWXUwk2HqBp6+2LEtrPjWiYcYNiScSNnT0M4s/lCHzT+wcIBWyg a1jYjOFrKl/baddH2SgMZTIKSAG5GNmPZcDGAImDQLwlsit/brDV7XdWaWIIhLR8e1BkE6TcAYs sMsldeEVRS+3x5H+Lyh0dqJ+OJixc= X-Received: by 2002:a05:6000:4201:b0:435:b674:c9b1 with SMTP id ffacd0b85a97d-436213d80b0mr874187f8f.11.1770237261689; Wed, 04 Feb 2026 12:34:21 -0800 (PST) Received: from localhost.localdomain ([196.235.235.199]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43617e38fbbsm9275097f8f.13.2026.02.04.12.34.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Feb 2026 12:34:21 -0800 (PST) From: Salah Triki To: Jonathan Cameron , David Lechner , =?UTF-8?q?Nuno=20S=C3=A1?= , Andy Shevchenko Cc: linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, Salah Triki Subject: [PATCH v2] iio: trigger: fix use-after-free in viio_trigger_alloc() Date: Wed, 4 Feb 2026 21:34:13 +0100 Message-ID: <20260204203414.89333-1-salah.triki@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Once `device_initialize()` is called, the reference count of the device is set to 1. The memory associated with the device must then be managed by the kobject reference counting via `put_device()`. Currently, if `irq_alloc_descs()` or `kvasprintf()` fails, the code manually calls `irq_free_descs()` and `kfree()`. This is problematic for two reasons: 1. Calling `kfree()` directly bypasses the device's release callback (`iio_trig_release()`), which could lead to resource leaks or inconsistencies within the driver core. 2. If we simply replace `kfree()` with `put_device()`, a double free occurs because `iio_trig_release()` already calls `irq_free_descs()`. Fix this by: - Using `put_device()` to handle memory tearing down. - Removing the manual call to `irq_free_descs()` in the error path, as it is already handled by the trigger's release function. Path to the issue: viio_trigger_alloc() -> device_initialize() (refcount =3D 1) -> kvasprintf() fails -> goto free_descs -> irq_free_descs() (first manual free) -> kfree(trig) (refcount is still 1, release never called) Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()") Signed-off-by: Salah Triki --- Changes in v2: - Remove the manual call to irq_free_descs() in the error path to avoid=20 a double free, as this is already handled by iio_trig_release(). - Clarify the error path and the potential for memory corruption in=20 the commit description. - Remove the blank line in the tag block to comply with kernel script=20 requirements. drivers/iio/industrialio-trigger.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-= trigger.c index 54416a384232..7f53e2a5a101 100644 --- a/drivers/iio/industrialio-trigger.c +++ b/drivers/iio/industrialio-trigger.c @@ -576,7 +576,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *p= arent, =20 trig->name =3D kvasprintf(GFP_KERNEL, fmt, vargs); if (trig->name =3D=3D NULL) - goto free_descs; + goto free_trig; =20 INIT_LIST_HEAD(&trig->list); =20 @@ -594,10 +594,8 @@ struct iio_trigger *viio_trigger_alloc(struct device *= parent, =20 return trig; =20 -free_descs: - irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER); free_trig: - kfree(trig); + put_device(&trig->dev); return NULL; } =20 --=20 2.43.0