Re: [PATCH 1/2] iio: mma8452: Fix trigger reference couting

[Jonathan Cameron <jic23@kernel.org>]

On Sun, 24 Oct 2021 11:26:59 +0200
Lars-Peter Clausen <lars@metafoo.de> wrote:

> The mma8452 driver directly assigns a trigger to the struct iio_dev. The
> IIO core when done using this trigger will call `iio_trigger_put()` to drop
> the reference count by 1.
> 
> Without the matching `iio_trigger_get()` in the driver the reference count
> can reach 0 too early, the trigger gets freed while still in use and a
> use-after-free occurs.
> 
> Fix this by getting a reference to the trigger before assigning it to the
> IIO device.
> 
> Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.")
> Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Gah. I thought we'd gotten all these years ago. I guess this one slipped through
the net.

Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan

> ---
>  drivers/iio/accel/mma8452.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
> index 715b8138fb71..09c7f10fefb6 100644
> --- a/drivers/iio/accel/mma8452.c
> +++ b/drivers/iio/accel/mma8452.c
> @@ -1470,7 +1470,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev)
>  	if (ret)
>  		return ret;
>  
> -	indio_dev->trig = trig;
> +	indio_dev->trig = iio_trigger_get(trig);
>  
>  	return 0;
>  }