[PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Guangshuo Li]

Unregistering an IIO device with an active triggered buffer detaches its
poll function. Freeing the poll function first can therefore make
iio_device_unregister() access freed memory.

Unregister the device before cleaning up the triggered buffer.

This issue was found by our static analysis tool under development.

Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 allmodconfig (W=1,
CONFIG_WERROR=n).
No runtime or fault-injection testing was performed.

 drivers/iio/accel/kxsd9.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 7ac885d94d7f..27adcdd31201 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -478,8 +478,8 @@ void kxsd9_common_remove(struct device *dev)
 	struct iio_dev *indio_dev = dev_get_drvdata(dev);
 	struct kxsd9_state *st = iio_priv(indio_dev);
 
-	iio_triggered_buffer_cleanup(indio_dev);
 	iio_device_unregister(indio_dev);
+	iio_triggered_buffer_cleanup(indio_dev);
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3

Re: [PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Joshua Crofts]

On Sat, 31 Oct 2026 21:05:38 +0800
Guangshuo Li <liguangshuo@mail.sdu.edu.cn> wrote:

> Unregistering an IIO device with an active triggered buffer detaches its
> poll function. Freeing the poll function first can therefore make
> iio_device_unregister() access freed memory.
> 
> Unregister the device before cleaning up the triggered buffer.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
> Assisted-by: OpenAI:gpt-6-astra

Drop this tag, it has been deprecated.

Otherwise LGTM.

Reviewed-by: Joshua Crofts <crofts@kernel.org>

-- 
Kind regards,
Joshua Crofts