Re: [PATCH v2] iio: buffer: hw-consumer: fix use-after-free in error path

[Nuno Sá]

On Thu, 2026-04-30 at 21:29 +0800, Felix Gu wrote:
> In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code
> was using list_for_each_entry() to iterate through buffers while calling
> iio_buffer_put() which can free the current buffer if refcount drops to 0.
> The list_for_each_entry() loop macro then evaluates buf->head.next to
> continue iteration, accessing the freed buffer.
> 
> Fix this by using list_for_each_entry_safe().
> 
> Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support")
> Reported-by: sashiko <sashiko-bot@xxxxxxxxxx>
> Closes:
> https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com
> Signed-off-by: Felix Gu <ustc.gu@xxxxxxxxx>
> ---
> Changes in v2:
> - Fix Andy's comment.
> - Add Reported-by tag.
> - Link to v1:
> https://lore.kernel.org/r/20260428-iio-buf-v1-1-dcc63ff7b800@xxxxxxxxx
> ---

LGTM

Reviewed-by: Nuno Sá <nuno.sa@xxxxxxxxxx>

>  drivers/iio/buffer/industrialio-hw-consumer.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/buffer/industrialio-hw-consumer.c
> b/drivers/iio/buffer/industrialio-hw-consumer.c
> index 24d7df603760..700528c9a0a4 100644
> --- a/drivers/iio/buffer/industrialio-hw-consumer.c
> +++ b/drivers/iio/buffer/industrialio-hw-consumer.c
> @@ -85,7 +85,7 @@ static struct hw_consumer_buffer *iio_hw_consumer_get_buffer(
>   */
>  struct iio_hw_consumer *iio_hw_consumer_alloc(struct device *dev)
>  {
> -	struct hw_consumer_buffer *buf;
> +	struct hw_consumer_buffer *buf, *tmp;
>  	struct iio_hw_consumer *hwc;
>  	struct iio_channel *chan;
>  	int ret;
> @@ -116,7 +116,7 @@ struct iio_hw_consumer *iio_hw_consumer_alloc(struct device
> *dev)
>  	return hwc;
>  
>  err_put_buffers:
> -	list_for_each_entry(buf, &hwc->buffers, head)
> +	list_for_each_entry_safe(buf, tmp, &hwc->buffers, head)
>  		iio_buffer_put(&buf->buffer);
>  	iio_channel_release_all(hwc->channels);
>  err_free_hwc:
> 
> ---
> base-commit: 7080e32d3f09d8688c4a87d81bdcc71f7f606b16
> change-id: 20260428-iio-buf-4c8559020a54
> 
> Best regards,