Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/drivers/iio/buffer
History
Exact
Felix Gu 6f5ed4f2c7 iio: buffer: hw-consumer: fix use-after-free in error path 
In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code
was using list_for_each_entry() to iterate through buffers while calling
iio_buffer_put() which can free the current buffer if refcount drops to 0.
The list_for_each_entry() loop macro then evaluates buf->head.next to
continue iteration, accessing the freed buffer.

Fix this by using list_for_each_entry_safe().

Fixes: 48b66f8f93 ("iio: Add hardware consumer buffer support")
Reported-by: sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Maxwell Doose <m32285159@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-05-15 12:05:34 +01:00
..
industrialio-buffer-cb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
industrialio-buffer-dma.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
industrialio-buffer-dmaengine.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
industrialio-hw-consumer.c iio: buffer: hw-consumer: fix use-after-free in error path 2026-05-15 12:05:34 +01:00
industrialio-triggered-buffer.c iio: buffer: Fix checkpatch.pl warning 2025-06-09 07:45:35 +01:00
Kconfig
kfifo_buf.c iio: core: Simplify IIO core managed APIs 2026-02-23 21:00:47 +00:00
Makefile