Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Jonathan Cameron <jic23@kernel.org>]

On Sat, 31 Jan 2026 10:23:33 +0100
Salah Triki <salah.triki@gmail.com> wrote:

Hi Salah,

This is a definitely case of the fix not being anywhere as simple
as it might look at first glance.

> Once `device_initialize()` is called, the reference count of the device
> is set to 1. The memory associated with the device must then be
> managed by the kobject reference counting.
> 
> In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> the device's release callback and can lead to a use-after-free or memory
> corruption.

In some cases yes it can cause problems, but please show me an actual
path to this in the description. It should indeed be tidied up.

> 
> Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> the memory is freed properly via `iio_trig_release()` when the reference
> count drops to zero.

This change is not sufficient and causes some cleanup to happen twice
thus introducing some bugs that weren't there before.
So take another look.

> 
> Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")
> 
No blank line here.  Scripts that commonly run on the kernel tree rely
on the the tags block having no blank lines in it to avoid false positives.

> Signed-off-by: Salah Triki <salah.triki@gmail.com>
> ---
>  drivers/iio/industrialio-trigger.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 54416a384232..981e19757870 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -597,7 +597,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
>  free_descs:
>  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
>  free_trig:
> -	kfree(trig);
> +	put_device(&trig->dev);
>  	return NULL;
>  }
>