Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Jonathan Cameron <jic23@kernel.org>]

On Mon, 02 Feb 2026 10:12:10 +0000
Nuno Sá <noname.nuno@gmail.com> wrote:

> Hi all,
> 
> On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:
> > On Sat, 31 Jan 2026 10:23:33 +0100
> > Salah Triki <salah.triki@gmail.com> wrote:
> > 
> > Hi Salah,
> > 
> > This is a definitely case of the fix not being anywhere as simple
> > as it might look at first glance.
> >   
> > > Once `device_initialize()` is called, the reference count of the device
> > > is set to 1. The memory associated with the device must then be
> > > managed by the kobject reference counting.
> > > 
> > > In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> > > the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> > > the device's release callback and can lead to a use-after-free or memory
> > > corruption.  
> > 
> > In some cases yes it can cause problems, but please show me an actual
> > path to this in the description. It should indeed be tidied up.  
> 
> >   
> > > 
> > > Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> > > the memory is freed properly via `iio_trig_release()` when the reference
> > > count drops to zero.  
> 
> Not the first time this pops up and I actually thought it was already fixed. But it seems we
> never got v5:
> 
> https://lore.kernel.org/linux-iio/20251110035838.37029-1-make24@iscas.ac.cn/

I thought so too :(

Sadly my tracking doesn't really extend to checking that a final version shows up
and I have the memory of a goldfish.

J
> 
> Andy already fixed it for the main iio_dev allocation:
> 
> https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/
> 
> - Nuno Sá
> >