Re: [PATCH] iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()

[Alexandru Ardelean]

On Tue, Oct 12, 2021 at 12:18 PM Yang Yingliang
<yangyingliang@xxxxxxxxxx> wrote:
>
> When __iio_buffer_alloc_sysfs_and_mask() failed, 'unwind_idx' should be
> set to 'i - 1' to prevent double-free when cleanup resources.
>
> BUG: KASAN: double-free or invalid-free in __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
> Call Trace:
>  kfree+0x117/0x4c0
>  __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
>  iio_buffers_alloc_sysfs_and_mask+0x60d/0x1570 [industrialio]
>  __iio_device_register+0x483/0x1a30 [industrialio]
>  ina2xx_probe+0x625/0x980 [ina2xx_adc]
>

Makes sense.
Thanks for the catch.

Reviewed-by: Alexandru Ardelean <ardeleanalex@xxxxxxxxx>

> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers")
> Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
> ---
>  drivers/iio/industrialio-buffer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index a95cc2da56be..5f4bd0b73d03 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1616,7 +1616,7 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev *indio_dev)
>                 buffer = iio_dev_opaque->attached_buffers[i];
>                 ret = __iio_buffer_alloc_sysfs_and_mask(buffer, indio_dev, i);
>                 if (ret) {
> -                       unwind_idx = i;
> +                       unwind_idx = i - 1;
>                         goto error_unwind_sysfs_and_mask;
>                 }
>         }
> --
> 2.25.1
>