Buffer-mode claims hold mlock to guarantee that the device remains in
buffer mode until the claim is released. Normal buffer updates take
info_exist_lock followed by mlock in iio_update_buffers().

However, iio_device_unregister() disables and deactivates all buffers
without taking mlock. This can invalidate buffer state, including
active_scan_mask, while a buffer-mode claim is held.

Take mlock in iio_disable_all_buffers() so that unregister honors the
mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering
matches iio_update_buffers().

Fixes: 0a8565425afd ("iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs")
Suggested-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Jinseob Kim <kimjinseob88@gmail.com>
---
 drivers/iio/industrialio-buffer.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 2c9ec93dff47..d60bad5492e7 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1377,6 +1377,10 @@ EXPORT_SYMBOL_GPL(iio_update_buffers);
 
 void iio_disable_all_buffers(struct iio_dev *indio_dev)
 {
+	struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev);
+
+	guard(mutex)(&iio_dev_opaque->mlock);
+
 	iio_disable_buffers(indio_dev);
 	iio_buffer_deactivate_all(indio_dev);
 }

base-commit: dceba8e581e3e8f475da0efbd7a73f3d9524ddd2
-- 
2.43.0

On Mon, Sep 21, 2026 at 03:24:21PM +0900, Jinseob Kim wrote:
> Buffer-mode claims hold mlock to guarantee that the device remains in
> buffer mode until the claim is released. Normal buffer updates take
> info_exist_lock followed by mlock in iio_update_buffers().
> 
> However, iio_device_unregister() disables and deactivates all buffers
> without taking mlock. This can invalidate buffer state, including
> active_scan_mask, while a buffer-mode claim is held.
> 
> Take mlock in iio_disable_all_buffers() so that unregister honors the
> mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering
> matches iio_update_buffers().
> 
> Fixes: 0a8565425afd ("iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs")
> Suggested-by: Jonathan Cameron <jic23@kernel.org>
> Signed-off-by: Jinseob Kim <kimjinseob88@gmail.com>
> ---

Reviewed-by: Nuno Sá <nuno.sa@analog.com>

>  drivers/iio/industrialio-buffer.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index 2c9ec93dff47..d60bad5492e7 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1377,6 +1377,10 @@ EXPORT_SYMBOL_GPL(iio_update_buffers);
>  
>  void iio_disable_all_buffers(struct iio_dev *indio_dev)
>  {
> +	struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev);
> +
> +	guard(mutex)(&iio_dev_opaque->mlock);
> +
>  	iio_disable_buffers(indio_dev);
>  	iio_buffer_deactivate_all(indio_dev);
>  }
> 
> base-commit: dceba8e581e3e8f475da0efbd7a73f3d9524ddd2
> -- 
> 2.43.0
> 

On Mon, 21 Sep 2026 15:24:21 +0900
Jinseob Kim <kimjinseob88@gmail.com> wrote:

> Buffer-mode claims hold mlock to guarantee that the device remains in
> buffer mode until the claim is released. Normal buffer updates take
> info_exist_lock followed by mlock in iio_update_buffers().
> 
> However, iio_device_unregister() disables and deactivates all buffers
> without taking mlock. This can invalidate buffer state, including
> active_scan_mask, while a buffer-mode claim is held.
> 
> Take mlock in iio_disable_all_buffers() so that unregister honors the
> mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering
> matches iio_update_buffers().
> 
> Fixes: 0a8565425afd ("iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs")
> Suggested-by: Jonathan Cameron <jic23@kernel.org>
> Signed-off-by: Jinseob Kim <kimjinseob88@gmail.com>
> ---

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts