From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793213169; b=GnoG1/5eawkVlGx6l8hJ858hoyn/pQdjQpozqETUKWqVhQ0afA0dcXMc05yQTI2yNYzJ FO5y/wTtua3pviJNovG4uDSBlnja7xwKxr44omXA6nguks4aQdHZIXGaNYnSDwrD92UqW r2SSxUtCboE0WPBBPCxaiN4kNYkMgCbIdkKnDj1Zq1ceJSpA/H3Snh1bNHkQp4Qv8DNkn c1hlo08oBwGOSOjOl/pVNDWoy7Hi4VnklLS9RbfVT8kF0FiIqfOM4ox/2+zaMAmM0KcWR u/D9JzJR4sddriZZTeuErrYrDB/ItQ+c2INLBjsvPWphPXaT9FoW7k+Dp7TZ5v+aW/A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793213169; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=up65b0bl77wX0RXhzzQjcTYbrkKN8eUW9EyOGdxs9gM=; b=rIyWxeh3gmEFxd+zcMAxuUc06i1yJg1r+7DsCYoWL8nkvdogz1AGlv6yyP1l86cv69a1 //KIkIqT8zn1oct5QkkIfYgxXciryedtwk8CbGBk643KH/Zh7qWL6HaIcpnq5xkJUAmKN al+Cq65r7ZwYoo5hglge8WVRNZzwQNkl6pJbCZ6INqykKiS6g0N6n+DKJTFd3yUue7jnL rKK3Nj52wkM7JkUxtrzmci/tI2SLCsSwpeEQzmOzzQ4mij0wX+YZ0KTVGhdjNNbKPOFdm vdTHMLjJM60XaTzrdyYsFZJ9OZTJ/41co79mYSq1ldiPxYzblJB9rTVASkGPkxPhdIw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=vcGQmgJL; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4153F606A31D; Wed, 28 Oct 2026 18:46:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=vcGQmgJL Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9148B1F01825; Wed, 28 Oct 2026 18:46:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793213169; bh=up65b0bl77wX0RXhzzQjcTYbrkKN8eUW9EyOGdxs9gM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=vcGQmgJLuM+ghVZgP5boQeemZ03DpGjkk2BW3rC6JYFSkSxsoXYx9bXbTP39l2tJR mS9heqjkykuAwJoYhJBPNuwFqsPTk8bHBClv80Yku52kyScI2Xh6/7L+oZMroWWbKD FJoNrfZz8bPfi5QxBvwAfSlIuChT5ksJZL/1L2WY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Song Li , Fan Wu , =?UTF-8?q?Nuno=20S=C3=A1?= , Jonathan Cameron , Sasha Levin Subject: [PATCH 6.1 0411/1887] iio: adc: ad_sigma_delta: fix use-after-free on unbind Date: Wed, 28 Oct 2026 17:41:47 +0100 Message-ID: <20261028170508.589474429@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu [ Upstream commit 9ee8306121495d2a25aa5d1bfd519f2748786b83 ] ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with devm_krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so ad_sd_trigger_handler() can still run and memcpy() incoming samples into the freed samples_buf. Fix this by preallocating the buffer in devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iio_device_unregister() has drained the trigger handler via free_irq(). Size it for the worst case of all sequencer slots being active; ad_sd_validate_scan_mask() already caps the number of active channels at num_slots. This issue was found by an in-house static analysis tool. Fixes: 8bea9af887de ("iio: adc: ad_sigma_delta: Add sequencer support") Cc: stable@vger.kernel.org Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron [ sashal: adapted buffer allocation to the unconditional buffer setup code. ] Signed-off-by: Sasha Levin --- drivers/iio/adc/ad_sigma_delta.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c index 914274ed899ec..45e0f638c0ed1 100644 --- a/drivers/iio/adc/ad_sigma_delta.c +++ b/drivers/iio/adc/ad_sigma_delta.c @@ -343,9 +343,8 @@ EXPORT_SYMBOL_NS_GPL(ad_sigma_delta_single_conversion, IIO_AD_SIGMA_DELTA); static int ad_sd_buffer_postenable(struct iio_dev *indio_dev) { struct ad_sigma_delta *sigma_delta = iio_device_get_drvdata(indio_dev); - unsigned int i, slot, samples_buf_size; + unsigned int i, slot; unsigned int channel; - uint8_t *samples_buf; int ret; if (sigma_delta->num_slots == 1) { @@ -378,15 +377,6 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev) return ret; } - samples_buf_size = ALIGN(slot * indio_dev->channels[0].scan_type.storagebits / 8, 8); - samples_buf_size += sizeof(int64_t); - samples_buf = devm_krealloc(&sigma_delta->spi->dev, sigma_delta->samples_buf, - samples_buf_size, GFP_KERNEL); - if (!samples_buf) - return -ENOMEM; - - sigma_delta->samples_buf = samples_buf; - spi_bus_lock(sigma_delta->spi->master); sigma_delta->bus_locked = true; sigma_delta->keep_cs_asserted = true; @@ -620,6 +610,7 @@ static int devm_ad_sd_probe_trigger(struct device *dev, struct iio_dev *indio_de int devm_ad_sd_setup_buffer_and_trigger(struct device *dev, struct iio_dev *indio_dev) { struct ad_sigma_delta *sigma_delta = iio_device_get_drvdata(indio_dev); + unsigned int samples_buf_size; int ret; sigma_delta->slots = devm_kcalloc(dev, sigma_delta->num_slots, @@ -627,6 +618,19 @@ int devm_ad_sd_setup_buffer_and_trigger(struct device *dev, struct iio_dev *indi if (!sigma_delta->slots) return -ENOMEM; + /* + * Worst-case size: all sequencer slots can be active, capped + * at num_slots by ad_sd_validate_scan_mask(). + */ + samples_buf_size = + ALIGN(sigma_delta->num_slots * + BITS_TO_BYTES(indio_dev->channels[0].scan_type.storagebits), + sizeof(s64)); + samples_buf_size += sizeof(s64); + sigma_delta->samples_buf = devm_kzalloc(dev, samples_buf_size, GFP_KERNEL); + if (!sigma_delta->samples_buf) + return -ENOMEM; + ret = devm_iio_triggered_buffer_setup(dev, indio_dev, &iio_pollfunc_store_time, &ad_sd_trigger_handler, -- 2.53.0