Re: [PATCH v2] iio: buffer: hold a reference while DMA-BUF is attached

[Jonathan Cameron <jic23@kernel.org>]

On Thu, 12 Nov 2026 15:09:40 +0800
Yaohan Li <shunsheng1218@gmail.com> wrote:

> iio_buffer_attach_dmabuf() stores an IIO buffer pointer in the DMA-BUF
> attachment without taking a buffer reference.  A delayed DMA fence
> completion can release the attachment after the IIO device has been
> unbound and its buffer freed.  The release callback then dereferences
> the stale buffer while detaching the DMA-BUF.
> 
> Take a reference when storing the buffer in the attachment, and drop
> it after the final detach or when the attach operation fails.  This
> keeps the buffer alive for the asynchronous completion path.
> 
> A KASAN-enabled test with a DMA-BUF-capable IIO test device reproduced
> the use-after-free on the unmodified kernel.  The same delayed
> completion sequence produced no report with the change applied.
> 
> Fixes: 3e26d9f08fbe0 ("iio: core: Add new DMABUF interface infrastructure")
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
> Reviewed-by: Nuno Sá <nuno.sa@analog.com>
> 
Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan