This is a note to let you know that I've just added the patch titled
iio: mma8452: Fix trigger reference couting
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iio-mma8452-fix-trigger-reference-couting.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From cd0082235783f814241a1c9483fb89e405f4f892 Mon Sep 17 00:00:00 2001
From: Lars-Peter Clausen <lars@xxxxxxxxxx>
Date: Sun, 24 Oct 2021 11:26:59 +0200
Subject: iio: mma8452: Fix trigger reference couting
From: Lars-Peter Clausen <lars@xxxxxxxxxx>
commit cd0082235783f814241a1c9483fb89e405f4f892 upstream.
The mma8452 driver directly assigns a trigger to the struct iio_dev. The
IIO core when done using this trigger will call `iio_trigger_put()` to drop
the reference count by 1.
Without the matching `iio_trigger_get()` in the driver the reference count
can reach 0 too early, the trigger gets freed while still in use and a
use-after-free occurs.
Fix this by getting a reference to the trigger before assigning it to the
IIO device.
Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.")
Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@xxxxxxxxxx
Cc: <Stable@xxxxxxxxxxxxxxx>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/iio/accel/mma8452.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -1470,7 +1470,7 @@ static int mma8452_trigger_setup(struct
if (ret)
return ret;
- indio_dev->trig = trig;
+ indio_dev->trig = iio_trigger_get(trig);
return 0;
}
Patches currently in stable-queue which might be from lars@xxxxxxxxxx are
queue-5.15/iio-trigger-fix-reference-counting.patch
queue-5.15/iio-itg3200-call-iio_trigger_notify_done-on-error.patch
queue-5.15/iio-ad7768-1-call-iio_trigger_notify_done-on-error.patch
queue-5.15/iio-dln2-check-return-value-of-devm_iio_trigger_register.patch
queue-5.15/iio-stk3310-don-t-return-error-code-in-interrupt-handler.patch
queue-5.15/iio-mma8452-fix-trigger-reference-couting.patch
queue-5.15/iio-kxsd9-don-t-return-error-code-in-trigger-handler.patch
queue-5.15/iio-ltr501-don-t-return-error-code-in-trigger-handler.patch
