From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE1912BE05A for ; Fri, 3 Jul 2026 17:23:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783099420; cv=none; b=MB45+yTfZ12SvyUfh7uH8HwDjrmsymQ7jDKoPpUahFUx3UmprKnIRTCyyxufBxemKUOw8ewlF+Jjo+qQv7D3CAa7tezbG+8GtEP5t0GjrkUxR9CS4Fi220dAs4JI4z2dR1Khd3543f2lp9qtD5EtUUV3qG9pFCexleYqwUa/wcs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783099420; c=relaxed/simple; bh=8HqZvmtSpKpbc4rAzW+Ze+DAfPCGyxrnTcJDK5klviY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=s2hdFK7ytHtihBU88w93IHCPZ30GTdQL2QB32a/TCeayrn+lcX56euuQSip56OTOJvHmCNZ4nZ1plNaYv1N7Bn55yXN2eSETf8HrtR1rvq4qsoZJnKsLAHWjcNBJsUBDERDS+fKFQ1E9xMT51Vic1s/cctpKB3kQmRLhtCCxD1E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ua9LD8QK; arc=none smtp.client-ip=209.85.210.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ua9LD8QK" Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-846970f0acaso671368b3a.3 for ; Fri, 03 Jul 2026 10:23:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783099418; x=1783704218; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=nmB60ZYgB9p5pDJ1IW0pInjCKWd5FsZYny8bxTgtxgE=; b=Ua9LD8QKBMii6ajblUKlRo9RyjV7r982zImoLS++8U75PDfNlk0sAv6AG9mqR8j2BW XjVygOakP0JFrATJc4vU9FC/l/vkD34wbk2lsdsnFxzUyf9SxfOH28/zgf+0CHccLna8 N3oWom18J/uYHNIEVe68SnN6kuQdctt/nrn9dxW/+Z2ARAm8xnEAZkIy1qvS4ogLySVx SDEVAtcQj4a+MPY9oWPj+1NUNx353Wl4y4M6ZvHRK/QZfpy6SvzQYWxbxV3Ow8Mr+3MS JhpBPhMMJVu2iOQuw+ryx4Zj+OvytI9+JvqfhRkFEyjGccBYfxpNdoi12Y+1OAqD0/T6 3cdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783099418; x=1783704218; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=nmB60ZYgB9p5pDJ1IW0pInjCKWd5FsZYny8bxTgtxgE=; b=Sd2SiZ68JSZcwuapk2rMofOubGn8al+hHyqKBB0sTAMZQ88sDwFJLhspo/5goWYuTq bGWpkKU/lGJd9MQYTkzkoE2Xf8nLNK9HqWzFNN6A8oocthck+eAnVBi3aSXlfdeFWe/H flWdDbNF8BaTltyyvgIlxfd+L8jwTLRUvV9gfLNjRH1x/gouqjIAMPnHyqnnkR/ePOjU amqgKjKkvOZkrzi7BPfTOqxu4HxU5YE2sH6O5T42F8dxutwFnKymDBC0RNuCAhuSodGh /7U6xNHZ7SDIjdw8CgCLxGBA1EI5faXniqM0LBvntReedIuRm3i0jzSwvqqpJByXHK+5 GVoA== X-Forwarded-Encrypted: i=1; AFNElJ+Uq4NMAXyH/JF7cjvb95xeAo7roMVvuLCDjl3UclRhBs8mw4WOoDFQZ38Pkbs35JYuhgWjpvHmOcnHUl8=@vger.kernel.org X-Gm-Message-State: AOJu0YxBbqvC2kroXrM92TyuVustiKmtLJrUTawh/0PHkbAZVakoJxB+ siYLBwkbNmCdee5UoTk47NS6tIxpoK5QE+mm5mHfkDIGdw4UxQujFF/vRMcLGsjD X-Gm-Gg: AfdE7cnTbhRy42ukyt2NZmrv5tvlaQcuFZ9XFU0Ecrhxgd7p/iGE96V2hbj7s2S+2YG zhlw1QzBy++lsILUWB3xSG17SandjUGO9FD7ZWv0KlcjDSW089S50TgguG13uFzjM4qXkQZhZQi RUbbyZYDBIhlXxC9rfTxkElXu+noNqAoqaY1TF343i0l1XUYVDLLS8KH/KpnzMpevWjQZwFoUzX PNirJjOTG3zs0niD+mN9RzHK3x5b7bxSLETVYRNeYrAMd1+GtIAbUOBsuD3kSBKVV93px9GFUrH BDaaXrnAZo/bCowBQ0zJzg/a5XVTnOGgyyxFIP+RjcM8hTkJbEPN+6C8sYNoU9vXlEkitxMVJcD 4kg7wc0xxQKzNO+or7PzzTY8yz88MJRdgiqto7GlHrp04UCYwVZvwZg+TseQw5NVIeJ2vzegcfH 5nt8e5sVezS7ibpCn2jEHDQjNnTWmfxCgQPdMiaQmzWeA5NWY= X-Received: by 2002:a05:6a21:490:b0:3bf:b960:6fc4 with SMTP id adf61e73a8af0-3c03e498393mr276344637.30.1783099418128; Fri, 03 Jul 2026 10:23:38 -0700 (PDT) Received: from birens-macbook-air.local ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30f0bb843fasm22278176eec.18.2026.07.03.10.23.34 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 03 Jul 2026 10:23:37 -0700 (PDT) From: Biren Pandya Date: Fri, 03 Jul 2026 22:53:22 +0530 Subject: [PATCH 1/2] iio: accel: kxsd9: fix use-after-free on remove Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260703-kxsd9-v3-proper-v1-1-e9f08af25d7e@gmail.com> References: <20260703-kxsd9-v3-proper-v1-0-e9f08af25d7e@gmail.com> In-Reply-To: <20260703-kxsd9-v3-proper-v1-0-e9f08af25d7e@gmail.com> To: Jonathan Cameron , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Linus Walleij Cc: linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Biren Pandya X-Mailer: b4 0.15.2 The kxsd9 driver currently calls iio_triggered_buffer_cleanup() before iio_device_unregister() in the remove() function. This order creates a race condition where userspace can still access sysfs or ioctl interfaces while the triggered buffers are being torn down, potentially leading to a use-after-free. Fix this by swapping the cleanup order. Unregister the IIO device first to guarantee that all userspace interfaces are destroyed and no new accesses can occur before cleaning up the triggered buffers. This vulnerability was flagged by the Sashiko automated review system. Link: https://sashiko.dev/#/patchset/20260621193036.78549-2-birenpandya@gmail.com Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya --- drivers/iio/accel/kxsd9.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c index 7ac885d94d7f4..27adcdd312014 100644 --- a/drivers/iio/accel/kxsd9.c +++ b/drivers/iio/accel/kxsd9.c @@ -478,8 +478,8 @@ void kxsd9_common_remove(struct device *dev) struct iio_dev *indio_dev = dev_get_drvdata(dev); struct kxsd9_state *st = iio_priv(indio_dev); - iio_triggered_buffer_cleanup(indio_dev); iio_device_unregister(indio_dev); + iio_triggered_buffer_cleanup(indio_dev); pm_runtime_get_sync(dev); pm_runtime_put_noidle(dev); pm_runtime_disable(dev); -- Git-155)