[PATCH] platform/x86: toshiba_acpi: fix UAF after IIO registration failure

[Guangshuo Li]

When iio_device_register() fails, the error path frees dev->indio_dev
but leaves the pointer non-NULL. Since the probe continues, a later
driver removal or a subsequent probe failure can reach
toshiba_acpi_remove(), which may call iio_device_unregister() and
iio_device_free() through the dangling pointer.

Set dev->indio_dev to NULL after freeing it so the remove path skips
the already-freed IIO device.

This issue was found by our static analysis tool under development.

Fixes: 98010f1ea0cc ("toshiba_acpi: Add IIO interface for accelerometer axis data")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/platform/x86/toshiba_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index a0b8060836d0..7a7afae0fe45 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -3493,6 +3493,7 @@ static int toshiba_acpi_probe(struct platform_device *pdev)
 		if (ret < 0) {
 			pr_err("Unable to register iio device\n");
 			iio_device_free(dev->indio_dev);
+			dev->indio_dev = NULL;
 		}
 	}
 iio_error:
-- 
2.43.0