On Tue, Oct 12, 2021 at 12:18 PM Yang Yingliang
<yangyingliang@xxxxxxxxxx> wrote:
>
> When __iio_buffer_alloc_sysfs_and_mask() failed, 'unwind_idx' should be
> set to 'i - 1' to prevent double-free when cleanup resources.
>
> BUG: KASAN: double-free or invalid-free in __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
> Call Trace:
> kfree+0x117/0x4c0
> __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
> iio_buffers_alloc_sysfs_and_mask+0x60d/0x1570 [industrialio]
> __iio_device_register+0x483/0x1a30 [industrialio]
> ina2xx_probe+0x625/0x980 [ina2xx_adc]
>
Makes sense.
Thanks for the catch.
Reviewed-by: Alexandru Ardelean <ardeleanalex@xxxxxxxxx>
> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers")
> Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
> ---
> drivers/iio/industrialio-buffer.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index a95cc2da56be..5f4bd0b73d03 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1616,7 +1616,7 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev *indio_dev)
> buffer = iio_dev_opaque->attached_buffers[i];
> ret = __iio_buffer_alloc_sysfs_and_mask(buffer, indio_dev, i);
> if (ret) {
> - unwind_idx = i;
> + unwind_idx = i - 1;
> goto error_unwind_sysfs_and_mask;
> }
> }
> --
> 2.25.1
>
