Re: [PATCH v2] iio: buffer: hw-consumer: fix use-after-free in error path

[Jonathan Cameron <jic23@kernel.org>]

On Thu, 30 Apr 2026 20:27:27 -0500
"Maxwell Doose" <m32285159@gmail.com> wrote:

> On Thu Apr 30, 2026 at 8:29 AM CDT, Felix Gu wrote:
> > In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code
> > was using list_for_each_entry() to iterate through buffers while calling
> > iio_buffer_put() which can free the current buffer if refcount drops to 0=  
> .
> > The list_for_each_entry() loop macro then evaluates buf->head.next to
> > continue iteration, accessing the freed buffer.
> >
> > Fix this by using list_for_each_entry_safe().
> >
> > Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support")
> > Reported-by: sashiko <sashiko-bot@kernel.org>
> > Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647@gmail.com
> > Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> > ---
> > Changes in v2:
> > - Fix Andy's comment.
> > - Add Reported-by tag.
> > - Link to v1: https://lore.kernel.org/r/20260428-iio-buf-v1-1-dcc63ff7b80@gmail.com
> > ---
> >  drivers/iio/buffer/industrialio-hw-consumer.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >  
> 
> Looks fine to me.
> 
> Reviewed-by: Maxwell Doose <m32285159@gmail.com>
> 
> best regards,
> maxwell
Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks

J
> 
> 
> 
> > Best regards,
> > --=
> > Felix Gu <ustc.gu@gmail.com>  
>