linux-kernel - Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 22 May 2022 12:04:09 +0100
From:   Jonathan Cameron <jic23@...nel.org>
To:     Lars-Peter Clausen <lars@...afoo.de>
Cc:     Vincent Whitchurch <vincent.whitchurch@...s.com>, kernel@...s.com,
        linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove

On Thu, 19 May 2022 11:58:03 +0200
Lars-Peter Clausen <lars@...afoo.de> wrote:

> On 5/19/22 11:19, Vincent Whitchurch wrote:
> > [...]
> >   
> >
> > Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
> > Signed-off-by: Vincent Whitchurch <vincent.whitchurch@...s.com>  
> 
> Thanks for the patch!
> 
> Strictly speaking the Fixes: should be
> 
> f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly 
> active trigger")
> 
> 
> Reviewed-by: Lars-Peter Clausen <lars@...afoo.de>
I've changed the fixes tag and applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

> 
> > ---
> >   drivers/iio/trigger/iio-trig-sysfs.c | 1 +
> >   1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
> > index 2a4b75897910..3d911c24b265 100644
> > --- a/drivers/iio/trigger/iio-trig-sysfs.c
> > +++ b/drivers/iio/trigger/iio-trig-sysfs.c
> > @@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
> >   	}
> >   
> >   	iio_trigger_unregister(t->trig);
> > +	irq_work_sync(&t->work);
> >   	iio_trigger_free(t->trig);
> >   
> >   	list_del(&t->l);  
> 
>