Re: [BUG] iio: gyro: mpu3050: use-after-free via trigger left on iio_trigger_list after unbind

[Joshua Crofts <joshua.crofts1@gmail.com>]

On Sat, 10 Oct 2026 16:36:01 -0400
Dingisoul <dingiso.kernel@gmail.com> wrote:

> Hi Kernel Maintainers,
> 
> I hit the following report while testing current upstream kernel:
> 
> KASAN: slab-use-after-free in mpu3050_drdy_trigger_set_state
> 
> on commit: a90ee4305c4a (2026-10-07)
> 
> Root cause: mpu3050_trigger_probe() registers the data-ready trigger with
> the non-devm iio_trigger_register(), with drvdata pointing at indio_dev:
> 
>     static int mpu3050_trigger_probe(struct iio_dev *indio_dev, int irq)
>     {
>         ...
>         mpu3050->trig->dev.parent = dev;
>         mpu3050->trig->ops = &mpu3050_trigger_ops;
>         iio_trigger_set_drvdata(mpu3050->trig, indio_dev);
> 
>         ret = iio_trigger_register(mpu3050->trig);  /* device_add() pins trig; no unregister on remove */
>         if (ret)
>             goto err_iio_trigger;
> 
>         indio_dev->trig = iio_trigger_get(mpu3050->trig);
> 
>         return 0;
>     }
> 
> mpu3050_common_remove() tears down everything else, but never calls
> iio_trigger_unregister() on mpu3050->trig:
> 
>     void mpu3050_common_remove(struct device *dev)
>     {
>         struct iio_dev *indio_dev = dev_get_drvdata(dev);
>         struct mpu3050 *mpu3050 = iio_priv(indio_dev);
> 
>         iio_device_unregister(indio_dev);  /* devm frees indio_dev's storage once this returns */
>         pm_runtime_get_sync(dev);
>         pm_runtime_put_noidle(dev);
>         pm_runtime_disable(dev);
>         if (mpu3050->irq)
>             free_irq(mpu3050->irq, mpu3050->trig);
>         iio_triggered_buffer_cleanup(indio_dev);
>         mpu3050_power_down(mpu3050);
>         /* trig is never unregistered: still on the global iio_trigger_list */
>     }
> 
> So after unbind, the trigger is still alive and discoverable by name on
> the global trigger list, with drvdata still pointing at the now-freed
> indio_dev. Any other IIO device with a triggered buffer can select it by
> name via trigger/current_trigger and enable its buffer, which reaches
> the leaked trigger's ->set_trigger_state() op:
> 
>     static int mpu3050_drdy_trigger_set_state(struct iio_trigger *trig,
>                                               bool enable)
>     {
>         struct iio_dev *indio_dev = iio_trigger_get_drvdata(trig);
>         struct mpu3050 *mpu3050 = iio_priv(indio_dev);  /* indio_dev is freed -- UAF read */
>         ...
> 
> The reproducer and .config files are here.
> https://gist.github.com/dingiso/985aa3eb2786b62f80e2e6780e9af090
> 
> I'm happy to test debug patches or provide additional information.
> 

Hi, thanks for the bug report!

I've sent a patch addressing the issue, it would be great if you
could test it.

https://lore.kernel.org/linux-iio/20261011-mpu3050-fix-v1-1-f55b0d138be4@gmail.com/

Thanks.

-- 
Kind regards,
Joshua Crofts