This is a note to let you know that I've just added the patch titled iio: mma8452: Fix trigger reference couting to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: iio-mma8452-fix-trigger-reference-couting.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From cd0082235783f814241a1c9483fb89e405f4f892 Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen <lars@xxxxxxxxxx> Date: Sun, 24 Oct 2021 11:26:59 +0200 Subject: iio: mma8452: Fix trigger reference couting From: Lars-Peter Clausen <lars@xxxxxxxxxx> commit cd0082235783f814241a1c9483fb89e405f4f892 upstream. The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.") Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx> Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@xxxxxxxxxx Cc: <Stable@xxxxxxxxxxxxxxx> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/iio/accel/mma8452.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -1470,7 +1470,7 @@ static int mma8452_trigger_setup(struct if (ret) return ret; - indio_dev->trig = trig; + indio_dev->trig = iio_trigger_get(trig); return 0; } Patches currently in stable-queue which might be from lars@xxxxxxxxxx are queue-5.15/iio-trigger-fix-reference-counting.patch queue-5.15/iio-itg3200-call-iio_trigger_notify_done-on-error.patch queue-5.15/iio-ad7768-1-call-iio_trigger_notify_done-on-error.patch queue-5.15/iio-dln2-check-return-value-of-devm_iio_trigger_register.patch queue-5.15/iio-stk3310-don-t-return-error-code-in-interrupt-handler.patch queue-5.15/iio-mma8452-fix-trigger-reference-couting.patch queue-5.15/iio-kxsd9-don-t-return-error-code-in-trigger-handler.patch queue-5.15/iio-ltr501-don-t-return-error-code-in-trigger-handler.patch