From: Dingisoul <dingiso.kernel@gmail.com>
To: joshua.crofts1@gmail.com
Cc: andy@kernel.org, dingiso.kernel@gmail.com, dlechner@baylibre.com,
jic23@kernel.org, linusw@kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org, nuno.sa@analog.com,
stable@vger.kernel.org
Subject: Re: [PATCH v2] iio: gyro: mpu3050: add missing trigger cleanup on remove
Date: Thu, 15 Oct 2026 16:35:59 -0400 [thread overview]
Message-ID: <20261015203559.2125485-1-dingiso.kernel@gmail.com> (raw)
In-Reply-To: <20261015221818.09527ff6@systembl0wer>
Hi Joshua,
v2 looks correct -- mpu3050->trig/mpu3050->irq are now only ever set
together after iio_trigger_register() succeeds, so the unregister/
free_irq guards in the error path and mpu3050_common_remove() can
never fire on a trigger or IRQ that was never actually acquired.
Applied it, rebuilt, and reran my reproducer: the trigger now gets
properly unregistered on unbind, so the attack just gets -EINVAL
instead of a UAF. No KASAN report, no warnings.
Tested-by: Dingisoul <dingiso.kernel@gmail.com>
Best,
Dingisoul
next prev parent reply other threads:[~2026-10-15 20:36 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 19:58 [PATCH v2] iio: gyro: mpu3050: add missing trigger cleanup on remove Joshua Crofts
2026-10-15 20:18 ` Joshua Crofts
2026-10-15 20:35 ` Dingisoul [this message]
2026-10-15 20:41 ` Joshua Crofts
2026-10-16 8:39 ` Nuno Sá
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261015203559.2125485-1-dingiso.kernel@gmail.com \
--to=dingiso.kernel@gmail.com \
--cc=andy@kernel.org \
--cc=dlechner@baylibre.com \
--cc=jic23@kernel.org \
--cc=joshua.crofts1@gmail.com \
--cc=linusw@kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nuno.sa@analog.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox