Re: [PATCH] iio: buffer: fix bounce buffer use-after-free on unregister

[Jonathan Cameron <jic23@kernel.org>]

On Fri, 06 Nov 2026 16:53:00 +0000
Nuno Sá <nuno.sa@analog.com> wrote:

> The bounce buffer used by iio_push_to_buffers_with_ts_unaligned() is
> allocated with devm_krealloc() against the IIO device itself. Since
> commit 699fb50d9903 ("drivers: base: Free devm resources when
> unregistering a device"), device_del() releases the devres of devices
> without a bound driver, so the bounce buffer is now freed from
> cdev_device_del() in iio_device_unregister().
> 
> At that point buffering may still be enabled, as
> iio_disable_all_buffers() only runs afterwards. A trigger handler
> firing in that window copies the sample into the freed bounce buffer
> and pushes it to the buffers.
> 
> To fix it, allocate the bounce buffer with plain krealloc() and free it
> in iio_dev_release().
> 
> Assisted-by: LLM
Rules on that changes (again!)
So dropped it.


> Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nuno Sá <nuno.sa@analog.com>
I think your analysis is right and even without that we should never
have been using that device for devm.  So good to clean this up either way!

Ideally we'd get some testing from someone who actually has a part
using this helper?  It is rare which is why we probably had not reports
of this yet (and remove problems only show up sometimes as many users
never hit that path)

Anyhow, I think very low risk and looks good so applied to
the fixes-togreg branch of iio.git.

thanks,

Jonathan

> ---
> Found this by accident and do note this is just code inspection. 
> 
> I tagged the original commit supporting the bounce_buffer in Fixes: but
> to be fair, the original commit was fine. Tagging 699fb50d9903 also
> looks bit odd but maybe it's the real one to blame?
> ---
>  drivers/iio/industrialio-buffer.c | 6 ++----
>  drivers/iio/industrialio-core.c   | 1 +
>  2 files changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index 4294101810fd..cc5fde0f5191 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -2464,10 +2464,8 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
>  	if (iio_dev_opaque->bounce_buffer_size !=  indio_dev->scan_bytes) {
>  		void *bb;
>  
> -		bb = devm_krealloc(&indio_dev->dev,
> -				   iio_dev_opaque->bounce_buffer,
> -				   indio_dev->scan_bytes,
> -				   GFP_KERNEL | __GFP_ZERO);
> +		bb = krealloc(iio_dev_opaque->bounce_buffer,
> +			      indio_dev->scan_bytes, GFP_KERNEL | __GFP_ZERO);
>  		if (!bb)
>  			return -ENOMEM;
>  		iio_dev_opaque->bounce_buffer = bb;
> diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
> index 825cf7f32059..ed097eb8d799 100644
> --- a/drivers/iio/industrialio-core.c
> +++ b/drivers/iio/industrialio-core.c
> @@ -1727,6 +1727,7 @@ static void iio_dev_release(struct device *device)
>  	lockdep_unregister_key(&iio_dev_opaque->mlock_key);
>  
>  	ida_free(&iio_ida, iio_dev_opaque->id);
> +	kfree(iio_dev_opaque->bounce_buffer);
>  	kfree(iio_dev_opaque);
>  }
>  
> 
> ---
> base-commit: 20ce8ef9c9e04cd6c5ae0422e251a9b5936c6b7c
> change-id: 20261106-iio-fix-possible-uaf-853ce6ff96bc
> --
> 
> Thanks!
> - Nuno Sá
>