On Sun, 24 Oct 2021 11:26:59 +0200
Lars-Peter Clausen <lars@xxxxxxxxxx> wrote:
> The mma8452 driver directly assigns a trigger to the struct iio_dev. The
> IIO core when done using this trigger will call `iio_trigger_put()` to drop
> the reference count by 1.
>
> Without the matching `iio_trigger_get()` in the driver the reference count
> can reach 0 too early, the trigger gets freed while still in use and a
> use-after-free occurs.
>
> Fix this by getting a reference to the trigger before assigning it to the
> IIO device.
>
> Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.")
> Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
Gah. I thought we'd gotten all these years ago. I guess this one slipped through
the net.
Applied to the fixes-togreg branch of iio.git and marked for stable.
Thanks,
Jonathan
> ---
> drivers/iio/accel/mma8452.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
> index 715b8138fb71..09c7f10fefb6 100644
> --- a/drivers/iio/accel/mma8452.c
> +++ b/drivers/iio/accel/mma8452.c
> @@ -1470,7 +1470,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev)
> if (ret)
> return ret;
>
> - indio_dev->trig = trig;
> + indio_dev->trig = iio_trigger_get(trig);
>
> return 0;
> }
