Re: [BUG] iio: gyro: mpu3050: use-after-free via trigger left on iio_trigger_list after unbind

[Joshua Crofts <joshua.crofts1@gmail.com>]

On Mon, 12 Oct 2026 16:09:04 -0400
Dingisoul <dingiso.kernel@gmail.com> wrote:

> Hi Joshua, Sashiko,
> 
> Sashiko's concern is really about not being able to tell whether the
> trigger was ever actually registered before calling
> iio_trigger_unregister(). There's a precedent for this exact bug class:
> commit 3c5eed894efd9 ("iio: temperature: tmp006: use
> devm_iio_trigger_register") hit the same
> devm_iio_trigger_alloc()-but-plain-register() mismatch in tmp006, and
> fixed it by switching to devm_iio_trigger_register() instead of adding a
> manual unregister call.
> 
>   https://github.com/torvalds/linux/commit/3c5eed894efd9
> 
> devm_iio_trigger_register() only installs its cleanup action if
> iio_trigger_register() actually succeeds:
> 
>     int devm_iio_trigger_register(struct device *dev,
>                                   struct iio_trigger *trig_info)
>     {
>         int ret;
> 
>         ret = iio_trigger_register(trig_info);
>         if (ret)
>             return ret;
> 
>         return devm_add_action_or_reset(dev, devm_iio_trigger_unreg, trig_info);
>     }
> 
> so it can never unregister a trigger that was never registered -- no
> flag/pointer tracking needed.
> 
> Suggested fix, in mpu3050_trigger_probe():
> 
>   -	ret = iio_trigger_register(mpu3050->trig);
>   +	ret = devm_iio_trigger_register(&indio_dev->dev, mpu3050->trig);

Ideally you shouldn't mix devm_* and non-devm_* function, this can cause headaches
down the road. Either we do the manual dance or we convert the entire driver to
devm_*. If you check the file in the commit you referenced above, you'll notice
that all the other functions are devm_*.

Bartosz Golaszewski had a talk on this at OSS Prague (recording still isn't
available, so I'm attaching the presentation instead).

https://hosted-files.sched.co/osselceu2026/0c/OSS%202026%20Prague.pdf

-- 
Kind regards,
Joshua Crofts