[PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Salah Triki]

Once `device_initialize()` is called, the reference count of the device
is set to 1. The memory associated with the device must then be
managed by the kobject reference counting.

In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
the code currently calls `kfree()`. Using `kfree()` in this case bypasses
the device's release callback and can lead to a use-after-free or memory
corruption.

Fix this by calling `put_device()` instead of `kfree()`. This ensures that
the memory is freed properly via `iio_trig_release()` when the reference
count drops to zero.

Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")

Signed-off-by: Salah Triki <salah.triki@gmail.com>
---
 drivers/iio/industrialio-trigger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 54416a384232..981e19757870 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -597,7 +597,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
 free_descs:
 	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
 free_trig:
-	kfree(trig);
+	put_device(&trig->dev);
 	return NULL;
 }
 
-- 
2.43.0

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Jonathan Cameron]

On Sat, 31 Jan 2026 10:23:33 +0100
Salah Triki <salah.triki@gmail.com> wrote:

Hi Salah,

This is a definitely case of the fix not being anywhere as simple
as it might look at first glance.

> Once `device_initialize()` is called, the reference count of the device
> is set to 1. The memory associated with the device must then be
> managed by the kobject reference counting.
> 
> In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> the device's release callback and can lead to a use-after-free or memory
> corruption.

In some cases yes it can cause problems, but please show me an actual
path to this in the description. It should indeed be tidied up.

> 
> Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> the memory is freed properly via `iio_trig_release()` when the reference
> count drops to zero.

This change is not sufficient and causes some cleanup to happen twice
thus introducing some bugs that weren't there before.
So take another look.

> 
> Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")
> 
No blank line here.  Scripts that commonly run on the kernel tree rely
on the the tags block having no blank lines in it to avoid false positives.

> Signed-off-by: Salah Triki <salah.triki@gmail.com>
> ---
>  drivers/iio/industrialio-trigger.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 54416a384232..981e19757870 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -597,7 +597,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
>  free_descs:
>  	irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
>  free_trig:
> -	kfree(trig);
> +	put_device(&trig->dev);
>  	return NULL;
>  }
>  

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Nuno Sá]

Hi all,

On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:
> On Sat, 31 Jan 2026 10:23:33 +0100
> Salah Triki <salah.triki@gmail.com> wrote:
> 
> Hi Salah,
> 
> This is a definitely case of the fix not being anywhere as simple
> as it might look at first glance.
> 
> > Once `device_initialize()` is called, the reference count of the device
> > is set to 1. The memory associated with the device must then be
> > managed by the kobject reference counting.
> > 
> > In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> > the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> > the device's release callback and can lead to a use-after-free or memory
> > corruption.
> 
> In some cases yes it can cause problems, but please show me an actual
> path to this in the description. It should indeed be tidied up.

> 
> > 
> > Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> > the memory is freed properly via `iio_trig_release()` when the reference
> > count drops to zero.

Not the first time this pops up and I actually thought it was already fixed. But it seems we
never got v5:

https://lore.kernel.org/linux-iio/20251110035838.37029-1-make24@iscas.ac.cn/

Andy already fixed it for the main iio_dev allocation:

https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/

- Nuno Sá
> 

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Jonathan Cameron]

On Mon, 02 Feb 2026 10:12:10 +0000
Nuno Sá <noname.nuno@gmail.com> wrote:

> Hi all,
> 
> On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:
> > On Sat, 31 Jan 2026 10:23:33 +0100
> > Salah Triki <salah.triki@gmail.com> wrote:
> > 
> > Hi Salah,
> > 
> > This is a definitely case of the fix not being anywhere as simple
> > as it might look at first glance.
> >   
> > > Once `device_initialize()` is called, the reference count of the device
> > > is set to 1. The memory associated with the device must then be
> > > managed by the kobject reference counting.
> > > 
> > > In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> > > the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> > > the device's release callback and can lead to a use-after-free or memory
> > > corruption.  
> > 
> > In some cases yes it can cause problems, but please show me an actual
> > path to this in the description. It should indeed be tidied up.  
> 
> >   
> > > 
> > > Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> > > the memory is freed properly via `iio_trig_release()` when the reference
> > > count drops to zero.  
> 
> Not the first time this pops up and I actually thought it was already fixed. But it seems we
> never got v5:
> 
> https://lore.kernel.org/linux-iio/20251110035838.37029-1-make24@iscas.ac.cn/

I thought so too :(

Sadly my tracking doesn't really extend to checking that a final version shows up
and I have the memory of a goldfish.

J
> 
> Andy already fixed it for the main iio_dev allocation:
> 
> https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/
> 
> - Nuno Sá
> >   

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Andy Shevchenko]

On Mon, Feb 02, 2026 at 08:52:17PM +0000, Jonathan Cameron wrote:
> On Mon, 02 Feb 2026 10:12:10 +0000
> Nuno Sá <noname.nuno@gmail.com> wrote:
> > On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:

...

> > Andy already fixed it for the main iio_dev allocation:
> > 
> > https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/

Right, and this thread makes me check the status and the series wasn't applied.
Now I need to go to that thread to see why.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Andy Shevchenko]

On Tue, Feb 03, 2026 at 01:18:14PM +0200, Andy Shevchenko wrote:
> On Mon, Feb 02, 2026 at 08:52:17PM +0000, Jonathan Cameron wrote:
> > On Mon, 02 Feb 2026 10:12:10 +0000
> > Nuno Sá <noname.nuno@gmail.com> wrote:
> > > On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:

...

> > > Andy already fixed it for the main iio_dev allocation:
> > > 
> > > https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/
> 
> Right, and this thread makes me check the status and the series wasn't applied.
> Now I need to go to that thread to see why.

And there it was mentioned as being applied... Confused.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Andy Shevchenko]

On Tue, Feb 03, 2026 at 01:20:02PM +0200, Andy Shevchenko wrote:
> On Tue, Feb 03, 2026 at 01:18:14PM +0200, Andy Shevchenko wrote:
> > On Mon, Feb 02, 2026 at 08:52:17PM +0000, Jonathan Cameron wrote:
> > > On Mon, 02 Feb 2026 10:12:10 +0000
> > > Nuno Sá <noname.nuno@gmail.com> wrote:
> > > > On Sat, 2026-01-31 at 12:44 +0000, Jonathan Cameron wrote:

...

> > > > Andy already fixed it for the main iio_dev allocation:
> > > > 
> > > > https://lore.kernel.org/linux-iio/20251112145735.2075527-3-andriy.shevchenko@linux.intel.com/
> > 
> > Right, and this thread makes me check the status and the series wasn't applied.
> > Now I need to go to that thread to see why.
> 
> And there it was mentioned as being applied... Confused.

Ah, I have some leftovers, need to clean my local tree. Sorry for the noise.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Salah Triki]

On Sat, Jan 31, 2026 at 12:44:16PM +0000, Jonathan Cameron wrote:
> On Sat, 31 Jan 2026 10:23:33 +0100
> Salah Triki <salah.triki@gmail.com> wrote:
> 
> Hi Salah,
> 
> This is a definitely case of the fix not being anywhere as simple
> as it might look at first glance.
> 
> > Once `device_initialize()` is called, the reference count of the device
> > is set to 1. The memory associated with the device must then be
> > managed by the kobject reference counting.
> > 
> > In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> > the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> > the device's release callback and can lead to a use-after-free or memory
> > corruption.
> 
> In some cases yes it can cause problems, but please show me an actual
> path to this in the description. It should indeed be tidied up.
> 
> > 
> > Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> > the memory is freed properly via `iio_trig_release()` when the reference
> > count drops to zero.
> 
> This change is not sufficient and causes some cleanup to happen twice
> thus introducing some bugs that weren't there before.
> So take another look.
> 
> > 
> > Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")
> > 
> No blank line here.  Scripts that commonly run on the kernel tree rely
> on the the tags block having no blank lines in it to avoid false positives.
> 
Hi Jonathan,

Thanks for the review!

You're right – my patch was incomplete and can lead to double cleanup
between the error path and iio_trig_release(). I'll rework the error
handling so that once device_initialize() has been called, all cleanup
goes through put_device(), and resource freeing is centralized in the
release callback.

I’ll send a v2 fixing the double-free issue, showing the error path 
and correcting the Fixes tag format.

Thanks!
Salah