From: Esben Haabendal <esben@geanix.com>
To: <sashiko-bot@kernel.org>
Cc: <sashiko-reviews@lists.linux.dev>, <conor+dt@kernel.org>,
<robh@kernel.org>, <devicetree@vger.kernel.org>
Subject: Re: [PATCH v6 8/9] iio: accel: mma8452: Fix use-after-free bug in error error path
Date: Fri, 28 Aug 2026 08:26:19 +0200 [thread overview]
Message-ID: <877blazrp0.fsf@geanix.com> (raw)
In-Reply-To: <20260825084130.89DBB1F00A3A@smtp.kernel.org> (sashiko-bot@kernel.org's message of "Tue, 25 Aug 2026 08:41:30 +0000")
<sashiko-bot@kernel.org> writes:
> Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] The device is left in ACTIVE mode on probe failure paths, potentially draining power and asserting interrupts indefinitely.
> - [High] The driver leaks the PM runtime usage count on multiple error paths when I2C reads/writes fail after acquiring a runtime PM reference.
> - [High] Time-of-check to time-of-use (TOCTOU) race condition during read-modify-write of I2C event configuration registers.
I will address these 3 in a new patch series after this one is merged.
> - [High] In `mma8452_runtime_suspend()`, if disabling the second regulator
> fails, the first regulator remains disabled but the PM state is left as
> RPM_ACTIVE.
This is fixed by patch from Sanjay Chitroda [1], which is currently in
iio testing branch.
> Sashiko AI review · https://sashiko.dev/#/patchset/20260825-mma8452-open-drain-v6-0-9b252804ee80@geanix.com?part=8
[1] https://lore.kernel.org/all/20260808-15-apr-pm-iio-mma8452-v4-temp-v5-1-d177e93ce3f8@gmail.com/
/Esben
next prev parent reply other threads:[~2026-08-28 6:26 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-25 8:27 [PATCH v6 0/9] io: accel: mma8452: Allow open drain interrupt pin configuration Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 1/9] dt-bindings: iio: accel: mma8452: Add drive-open-drain Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 2/9] iio: accel: mma8452: Optimize struct mma8452_data member orders Esben Haabendal
2026-08-25 8:38 ` sashiko-bot
2026-08-28 10:00 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 3/9] iio: accel: mma8452: Only apply trigger type when not set by firmware Esben Haabendal
2026-08-25 8:43 ` sashiko-bot
2026-08-28 9:48 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 4/9] iio: accel: mma8452: Support interrupt sharing Esben Haabendal
2026-08-25 8:42 ` sashiko-bot
2026-08-25 11:39 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 5/9] iio: accel: mma8452: Allow open drain interrupt pin configuration Esben Haabendal
2026-08-25 8:42 ` sashiko-bot
2026-08-25 13:26 ` Esben Haabendal
2026-08-28 9:42 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 6/9] iio: accel: mma8452: Reuse existing dev pointer in mma8452_probe() Esben Haabendal
2026-08-25 8:38 ` sashiko-bot
2026-08-25 11:15 ` Esben Haabendal
2026-08-28 9:40 ` Esben Haabendal
2026-08-26 7:27 ` Andy Shevchenko
2026-08-28 6:20 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 7/9] iio: accel: mma8452: Drop unneeded lock acquire on read Esben Haabendal
2026-08-25 8:45 ` sashiko-bot
2026-08-25 10:17 ` Joshua Crofts
2026-08-25 13:35 ` Esben Haabendal
2026-08-25 13:44 ` Joshua Crofts
2026-08-25 14:06 ` Esben Haabendal
2026-08-28 6:29 ` Esben Haabendal
2026-08-25 8:27 ` [PATCH v6 8/9] iio: accel: mma8452: Fix use-after-free bug in error error path Esben Haabendal
2026-08-25 8:41 ` sashiko-bot
2026-08-28 6:26 ` Esben Haabendal [this message]
2026-08-25 8:27 ` [PATCH v6 9/9] iio: accel: mma8452: Use proper error code when missing device model Esben Haabendal
2026-08-25 8:40 ` sashiko-bot
2026-08-28 6:27 ` Esben Haabendal
2026-08-25 10:23 ` Joshua Crofts
2026-08-25 11:00 ` Esben Haabendal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877blazrp0.fsf@geanix.com \
--to=esben@geanix.com \
--cc=conor+dt@kernel.org \
--cc=devicetree@vger.kernel.org \
--cc=robh@kernel.org \
--cc=sashiko-bot@kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox