[PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Guangshuo Li]

Unregistering an IIO device with an active triggered buffer detaches its
poll function. Freeing the poll function first can therefore make
iio_device_unregister() access freed memory.

Unregister the device before cleaning up the triggered buffer.

This issue was found by our static analysis tool under development.

Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 allmodconfig (W=1,
CONFIG_WERROR=n).
No runtime or fault-injection testing was performed.

 drivers/iio/accel/kxsd9.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 7ac885d94d7f..27adcdd31201 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -478,8 +478,8 @@ void kxsd9_common_remove(struct device *dev)
 	struct iio_dev *indio_dev = dev_get_drvdata(dev);
 	struct kxsd9_state *st = iio_priv(indio_dev);
 
-	iio_triggered_buffer_cleanup(indio_dev);
 	iio_device_unregister(indio_dev);
+	iio_triggered_buffer_cleanup(indio_dev);
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3

Re: [PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Joshua Crofts]

On Sat, 31 Oct 2026 21:05:38 +0800
Guangshuo Li <liguangshuo@mail.sdu.edu.cn> wrote:

> Unregistering an IIO device with an active triggered buffer detaches its
> poll function. Freeing the poll function first can therefore make
> iio_device_unregister() access freed memory.
> 
> Unregister the device before cleaning up the triggered buffer.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
> Assisted-by: OpenAI:gpt-6-astra

Drop this tag, it has been deprecated.

Otherwise LGTM.

Reviewed-by: Joshua Crofts <crofts@kernel.org>

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Jonathan Cameron]

On Sat, 31 Oct 2026 21:05:38 +0800
Guangshuo Li <liguangshuo@mail.sdu.edu.cn> wrote:

> Unregistering an IIO device with an active triggered buffer detaches its
> poll function. Freeing the poll function first can therefore make
> iio_device_unregister() access freed memory.
> 
> Unregister the device before cleaning up the triggered buffer.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
> Assisted-by: OpenAI:gpt-6-astra
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
Applied with tag dropped as Joshua pointed out and with stable added.

Thanks,

Jonathan

> ---
> Build-tested the changed object with x86_64 allmodconfig (W=1,
> CONFIG_WERROR=n).
> No runtime or fault-injection testing was performed.
> 
>  drivers/iio/accel/kxsd9.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
> index 7ac885d94d7f..27adcdd31201 100644
> --- a/drivers/iio/accel/kxsd9.c
> +++ b/drivers/iio/accel/kxsd9.c
> @@ -478,8 +478,8 @@ void kxsd9_common_remove(struct device *dev)
>  	struct iio_dev *indio_dev = dev_get_drvdata(dev);
>  	struct kxsd9_state *st = iio_priv(indio_dev);
>  
> -	iio_triggered_buffer_cleanup(indio_dev);
>  	iio_device_unregister(indio_dev);
> +	iio_triggered_buffer_cleanup(indio_dev);
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> 
> base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
>