From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C19B53B6354 for ; Mon, 6 Jul 2026 07:47:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783324033; cv=none; b=Ev8218PwfzsdooO0sODnf4m69ELhakQcPWgsJQKzbg1Q/Hr0tJic4oe/V3CAwOreEhBaILMIOeQCuhN9ZlhKpgtFOG32UdUhUqOEPPmQp9ODVx6OxVq0SDhQCIp2dW9DOoABGqFespsYv/wO5lzz82l9TxN2EEf6RHZFy8wA2mA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783324033; c=relaxed/simple; bh=o2u3tmJ4dbMJ8f3Ubk+i85Rmq4bTjeWeJ9eBvYu7rDE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NjIqUS26ZG+d8K6ftGEV1rzHW7tXBHlW5UnHHTSDl6VA3CWbAJcULpOAumop0yBJg4xmRChzOXMdfheYK6cRhUN0/3C4FzcG+B0A4eQDytLfKC0IQASihZZFjMf+MjPy7mJXS2jgn9ak4VvbIpHQ7cY3ollg16Ox2Ybvt5Kb/3A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HU30eZiO; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HU30eZiO" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-c9d1fff21edso1928639a12.1 for ; Mon, 06 Jul 2026 00:47:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783324020; x=1783928820; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Y41AW65ugwoCZQW1jZyzd6ERQyYcwsnWPoHTIi1U8oQ=; b=HU30eZiO+XODkeoqTRPlMy11WyuhFZ+VF50Tn5gaGl/u1GsThYAkDNEZRl8MQEH3jD 1OhIbKAOhr3xUcjcbcD+MKE1LAwhcESNTD52UeRfa7tfOOZNqUPRi+XHn3juvipVbUtL v7bhzbhJpSdVpjuZL8+24nxCZu5op+me7MIlMjw/DDWh67lDzfZME5xSIZw1652Bhsvy H+htdp1Wuch4lZx3yekB4SXOJ74SihBGmZ7mm1hHqirNQjzX7Ks5VnrOYvGn+c5IMce5 TlKFBT2SDFKqLDRwgzAd0TYE0ljm1j9WmXQVQQZt5DhxZSmDrn8jUDA+cTno/8aK34OV P7gA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783324020; x=1783928820; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Y41AW65ugwoCZQW1jZyzd6ERQyYcwsnWPoHTIi1U8oQ=; b=h6GtXKKL2uqfpf4c7oiAXOJrDEWWM1DD0IksFJP5IKTfpcH9aWQ4px3FCiZ1Mg65+T bwBde3mnkhea3IFzC3RlmC1w5jP4LXsEZKQM0MBO/YppxvetuojXfi3yetbEgOpl+vcq kH9VWWkHUpfWGY++fGTCR3hAovRFeZl6eYvdrSclmoa/Uj+hD1RYh77qMm0SjE37Duzk zty+PkAbaUV4N54F/0tGLS2NhOwMR/sjmpcluQiy8rc0bL+FhI1cwVZEUSgERXwmZzBs d2Fgo6svM3MDF0E6WtWYFJg/xdfX7jazjcrDBjSnp+0Qifxu+sfjQMrMwTAcqXlcuV9Z 4XbQ== X-Forwarded-Encrypted: i=1; AHgh+RrFba1yTpXGeufzrC3//neOJDio34k5apd8o1d9rC3JvaZDrT/8Ih4oYOitKi3EyUYhf1iUHSHzGRQpQgc=@vger.kernel.org X-Gm-Message-State: AOJu0Yyhd/KWJ0d1v3+rrkKpe24sF5iEXP+wvOnaUVmIu8yESzawq52a trxmm03uCh2vSwQ0zlhoH6XHPkeLIsXZX+kzykETo27mdCCZcs2Is5c4 X-Gm-Gg: AfdE7cmvPv04dHBJDp7t5xUKEo081O41QpaaeM1dVoA6TFgcIazIYAIN26jdQrBCHj9 NFQvVGW91kUmGEx4NnA+7/3E5xn3HBEDBsJTIwxyu6EMSdYIh/i8G8TRHaH1dyURqICHymXzDzG 638a+PS/iQCsfX6/vgYY2kofRSU74mkdNS/DDfTVhihodjBA3ZWwjrQc6gau06OtcolnU5EsDVZ gGynmsXKCFz/jHnFCQQMzCkmubuHY7GmSE86ktE0pOhYXfGD7zSlRtx9OxEUP42KV8CX4wPCLuK /WSyRE6iL/+Qqre7xL8t+1IuuvDtUfzg1jrzMJ6CA2aEpbHVTDGJEdlxhVc00DDw0brMv6SXhVc 8jtOMJKSyBQeazVTVT8envC+ax88807tRJT+EMT7dhdNYsM38k0N608H9iuQhtEAFXL2YClP8xw 3sV8yQSWgyxOPfu54ivaOvqhM4cqj2mBG61dNImJzUNAs= X-Received: by 2002:a05:6a20:5499:b0:3bf:a8d7:4f4a with SMTP id adf61e73a8af0-3c03e50ca0bmr9757761637.40.1783324019938; Mon, 06 Jul 2026 00:46:59 -0700 (PDT) Received: from localhost.localdomain ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b3c7ef5b3sm67081836c88.1.2026.07.06.00.46.55 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 06 Jul 2026 00:46:59 -0700 (PDT) From: Biren Pandya To: Jonathan Cameron Cc: David Lechner , =?UTF-8?q?Nuno=20S=C3=A1?= , Andy Shevchenko , Sakari Ailus , Linus Walleij , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, Biren Pandya , stable@vger.kernel.org Subject: [PATCH v3 1/2] iio: accel: kxsd9: fix Use-After-Free in remove() Date: Mon, 6 Jul 2026 13:16:51 +0530 Message-ID: <20260706074650.96042-3-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The kxsd9 driver currently calls iio_triggered_buffer_cleanup() before iio_device_unregister() in the remove() function. This order creates a race condition where userspace can still access sysfs or ioctl interfaces while the triggered buffers are being torn down, potentially leading to a use-after-free. Fix this by swapping the cleanup order. Unregister the IIO device first to guarantee that all userspace interfaces are destroyed and no new accesses can occur before cleaning up the triggered buffers. This vulnerability was flagged by the Sashiko automated review system. Link: https://sashiko.dev/#/patchset/20260621193036.78549-2-birenpandya@gmail.com Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya --- drivers/iio/accel/kxsd9.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c index 4717d80fc24af..7569201ed3c75 100644 --- a/drivers/iio/accel/kxsd9.c +++ b/drivers/iio/accel/kxsd9.c @@ -477,8 +477,8 @@ void kxsd9_common_remove(struct device *dev) struct iio_dev *indio_dev = dev_get_drvdata(dev); struct kxsd9_state *st = iio_priv(indio_dev); - iio_triggered_buffer_cleanup(indio_dev); iio_device_unregister(indio_dev); + iio_triggered_buffer_cleanup(indio_dev); pm_runtime_get_sync(dev); pm_runtime_put_noidle(dev); pm_runtime_disable(dev); -- 2.50.1 (Apple Git-155)