Quoting Tzung-Bi Shih (2023-08-28 20:06:22) > cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and > calls iio_push_to_buffers_with_timestamp() without making sure the > `indio_dev` stays in buffer mode. There is a race if `indio_dev` exits > buffer mode right before cros_ec_sensors_push_data() accesses them. > > An use-after-free on `indio_dev->active_scan_mask` was observed. The > call trace: > [...] > _find_next_bit > cros_ec_sensors_push_data > cros_ec_sensorhub_event > blocking_notifier_call_chain > cros_ec_irq_thread > > It was caused by a race condition: one thread just freed > `active_scan_mask` at [1]; while another thread tried to access the > memory at [2]. > > Fix it by calling iio_device_claim_buffer_mode() to ensure the > `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data(). > > [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189 > [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198 > > Cc: stable@xxxxxxxxxxxxxxx > Fixes: aa984f1ba4a4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO") > Signed-off-by: Tzung-Bi Shih <tzungbi@xxxxxxxxxx> > --- Reviewed-by: Stephen Boyd <swboyd@xxxxxxxxxxxx>
