Re: [PATCH v8 2/9] iio: accel: mma8452: Fix use-after-free bug in error error path

[Jonathan Cameron]

On Mon, 07 Sep 2026 16:50:57 +0200
Esben Haabendal <esben@xxxxxxxxxx> wrote:

> If mma8452_probe() fails in iio_device_register() or later, we could end up
> with runtime suspend callback being called with a now freed device pointer.
> 
> Fixes: 96c0cb2bbfe0 ("iio: mma8452: add support for runtime power management")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> Signed-off-by: Esben Haabendal <esben@xxxxxxxxxx>

Sashiko calls out some preexisting stuff that is worth a look
https://sashiko.dev/#/patchset/20260907-mma8452-open-drain-v8-0-c17407e22118%40geanix.com

Why freefall mode is set after the iio_device_register() is indeed an interesting
question. Any idea?

As far as it goes this patch is fine. I'm not sure about the other sashiko
comment about making sure the device is suspended. Given pm_runtime_set_active()
is called I would assume that one of the register sequences has indeed
turned on the device (maybe the reset?) and we should be turning it off again.

Jonathan

> ---
>  drivers/iio/accel/mma8452.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
> index fe62a903f0e2..a937cbd84f30 100644
> --- a/drivers/iio/accel/mma8452.c
> +++ b/drivers/iio/accel/mma8452.c
> @@ -1681,7 +1681,7 @@ static int mma8452_probe(struct i2c_client *client)
>  
>  	ret = iio_device_register(indio_dev);
>  	if (ret < 0)
> -		goto free_irq;
> +		goto runtime_suspend;
>  
>  	ret = mma8452_set_freefall_mode(data, false);
>  	if (ret < 0)
> @@ -1692,6 +1692,10 @@ static int mma8452_probe(struct i2c_client *client)
>  unregister_device:
>  	iio_device_unregister(indio_dev);
>  
> +runtime_suspend:
> +	pm_runtime_disable(dev);
> +	pm_runtime_set_suspended(dev);
> +
>  free_irq:
>  	if (client->irq)
>  		free_irq(client->irq, indio_dev);
>