On 10/28/21 4:07 PM, Jonathan Cameron wrote:
On Sun, 24 Oct 2021 11:26:59 +0200
Lars-Peter Clausen <lars@xxxxxxxxxx> wrote:
The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call `iio_trigger_put()` to drop
the reference count by 1.
Without the matching `iio_trigger_get()` in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.
Fix this by getting a reference to the trigger before assigning it to the
IIO device.
Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.")
Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
Gah. I thought we'd gotten all these years ago. I guess this one slipped through
the net.
Btw. we already have iio_trigger_set_immutable(), which handles the
reference counting. I was think of adding a iio(_device)_trigger_set()
that does the same except not setting the trig_readonly flag. And then
eventually move the trigger to iio_dev_opaque. Any concerns with this?
