[PATCH v2] iio: buffer: hold a reference while DMA-BUF is attached

[PATCH v2] iio: buffer: hold a reference while DMA-BUF is attached

[Yaohan Li]

iio_buffer_attach_dmabuf() stores an IIO buffer pointer in the DMA-BUF
attachment without taking a buffer reference.  A delayed DMA fence
completion can release the attachment after the IIO device has been
unbound and its buffer freed.  The release callback then dereferences
the stale buffer while detaching the DMA-BUF.

Take a reference when storing the buffer in the attachment, and drop
it after the final detach or when the attach operation fails.  This
keeps the buffer alive for the asynchronous completion path.

A KASAN-enabled test with a DMA-BUF-capable IIO test device reproduced
the use-after-free on the unmodified kernel.  The same delayed
completion sequence produced no report with the change applied.

Fixes: 3e26d9f08fbe0 ("iio: core: Add new DMABUF interface infrastructure")
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>

---
Changes since v1:
- Dropped the nonstandard Assisted-by trailer.
- Added Nuno Sá's Reviewed-by tag.
- The fix and the QEMU/KASAN tests were developed with AI assistance
  (ZCode/GLM-4); the author reviewed the patch and the test results.
v1: https://lore.kernel.org/r/179378580164.73301.2666197876060323279@gmail.com/
---
 drivers/iio/industrialio-buffer.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 4294101810fd7..bfa6d19471126 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1597,6 +1597,8 @@ static void iio_buffer_dmabuf_release(struct kref *ref)
 
 	buffer->access->detach_dmabuf(buffer, priv->block);
 
+	iio_buffer_put(buffer);
+
 	dma_buf_detach(attach->dmabuf, attach);
 	dma_buf_put(dmabuf);
 	kfree(priv);
@@ -1741,7 +1743,13 @@ static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib,
 	}
 
 	kref_init(&priv->ref);
-	priv->buffer = buffer;
+	/*
+	 * Hold a reference for the asynchronous dmabuf completion path
+	 * (iio_buffer_cleanup() -> iio_buffer_dmabuf_put() may run from a
+	 * work item after the device has been unbound); released in
+	 * iio_buffer_dmabuf_release().
+	 */
+	priv->buffer = iio_buffer_get(buffer);
 	priv->attach = attach;
 	attach->importer_priv = priv;
 
@@ -1789,6 +1797,7 @@ static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib,
 err_dmabuf_put:
 	dma_buf_put(dmabuf);
 err_free_priv:
+	iio_buffer_put(priv->buffer);
 	kfree(priv);
 
 	return err;
-- 
2.34.1

Re: [PATCH v2] iio: buffer: hold a reference while DMA-BUF is attached

[Jonathan Cameron]

On Thu, 12 Nov 2026 15:09:40 +0800
Yaohan Li <shunsheng1218@gmail.com> wrote:

> iio_buffer_attach_dmabuf() stores an IIO buffer pointer in the DMA-BUF
> attachment without taking a buffer reference.  A delayed DMA fence
> completion can release the attachment after the IIO device has been
> unbound and its buffer freed.  The release callback then dereferences
> the stale buffer while detaching the DMA-BUF.
> 
> Take a reference when storing the buffer in the attachment, and drop
> it after the final detach or when the attach operation fails.  This
> keeps the buffer alive for the asynchronous completion path.
> 
> A KASAN-enabled test with a DMA-BUF-capable IIO test device reproduced
> the use-after-free on the unmodified kernel.  The same delayed
> completion sequence produced no report with the change applied.
> 
> Fixes: 3e26d9f08fbe0 ("iio: core: Add new DMABUF interface infrastructure")
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
> Reviewed-by: Nuno Sá <nuno.sa@analog.com>
> 
Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan