linux-kernel - Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260131124416.19576731@jic23-huawei>
Date: Sat, 31 Jan 2026 12:44:16 +0000
From: Jonathan Cameron <jic23@...nel.org>
To: Salah Triki <salah.triki@...il.com>
Cc: David Lechner <dlechner@...libre.com>, Nuno Sá
 <nuno.sa@...log.com>, Andy Shevchenko <andy@...nel.org>,
 linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: trigger: fix use-after-free in
 viio_trigger_alloc()

On Sat, 31 Jan 2026 10:23:33 +0100
Salah Triki <salah.triki@...il.com> wrote:

Hi Salah,

This is a definitely case of the fix not being anywhere as simple
as it might look at first glance.

> Once `device_initialize()` is called, the reference count of the device
> is set to 1. The memory associated with the device must then be
> managed by the kobject reference counting.
> 
> In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> the device's release callback and can lead to a use-after-free or memory
> corruption.

In some cases yes it can cause problems, but please show me an actual
path to this in the description. It should indeed be tidied up.

> 
> Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> the memory is freed properly via `iio_trig_release()` when the reference
> count drops to zero.

This change is not sufficient and causes some cleanup to happen twice
thus introducing some bugs that weren't there before.
So take another look.

> 
> Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")
> 
No blank line here.  Scripts that commonly run on the kernel tree rely
on the the tags block having no blank lines in it to avoid false positives.

> Signed-off-by: Salah Triki <salah.triki@...il.com>
> ---
>  drivers/iio/industrialio-trigger.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 54416a384232..981e19757870 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -597,7 +597,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
>  free_descs:
>  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
>  free_trig:
> -	kfree(trig);
> +	put_device(&trig->dev);
>  	return NULL;
>  }
>