Re: [BUG] iio: gyro: mpu3050: use-after-free via trigger left on iio_trigger_list after unbind

[Dingisoul <dingiso.kernel@gmail.com>]

Hi Joshua, Sashiko,

Sashiko's concern is really about not being able to tell whether the
trigger was ever actually registered before calling
iio_trigger_unregister(). There's a precedent for this exact bug class:
commit 3c5eed894efd9 ("iio: temperature: tmp006: use
devm_iio_trigger_register") hit the same
devm_iio_trigger_alloc()-but-plain-register() mismatch in tmp006, and
fixed it by switching to devm_iio_trigger_register() instead of adding a
manual unregister call.

  https://github.com/torvalds/linux/commit/3c5eed894efd9

devm_iio_trigger_register() only installs its cleanup action if
iio_trigger_register() actually succeeds:

    int devm_iio_trigger_register(struct device *dev,
                                  struct iio_trigger *trig_info)
    {
        int ret;

        ret = iio_trigger_register(trig_info);
        if (ret)
            return ret;

        return devm_add_action_or_reset(dev, devm_iio_trigger_unreg, trig_info);
    }

so it can never unregister a trigger that was never registered -- no
flag/pointer tracking needed.

Suggested fix, in mpu3050_trigger_probe():

  -	ret = iio_trigger_register(mpu3050->trig);
  +	ret = devm_iio_trigger_register(&indio_dev->dev, mpu3050->trig);

(same scope devm_iio_trigger_alloc() already uses a few lines above).
With this, both iio_trigger_unregister() calls in your patch can be
dropped.

I rebuilt with just this one-line change and reran my reproducer:
the trigger registers normally on probe, and after delete_device 
it's actually gone instead of left dangling, so the attack just 
gets -EINVAL instead of a UAF. No KASAN report, no warnings.

Happy to test further revisions.

Best,
Dingisoul