Re: [PATCH] iio: trigger: fix use-after-free in viio_trigger_alloc()

[Salah Triki]

On Sat, Jan 31, 2026 at 12:44:16PM +0000, Jonathan Cameron wrote:
> On Sat, 31 Jan 2026 10:23:33 +0100
> Salah Triki <salah.triki@xxxxxxxxx> wrote:
> 
> Hi Salah,
> 
> This is a definitely case of the fix not being anywhere as simple
> as it might look at first glance.
> 
> > Once `device_initialize()` is called, the reference count of the device
> > is set to 1. The memory associated with the device must then be
> > managed by the kobject reference counting.
> > 
> > In `viio_trigger_alloc()`, if `irq_alloc_descs()` or `kvasprintf()` fails,
> > the code currently calls `kfree()`. Using `kfree()` in this case bypasses
> > the device's release callback and can lead to a use-after-free or memory
> > corruption.
> 
> In some cases yes it can cause problems, but please show me an actual
> path to this in the description. It should indeed be tidied up.
> 
> > 
> > Fix this by calling `put_device()` instead of `kfree()`. This ensures that
> > the memory is freed properly via `iio_trig_release()` when the reference
> > count drops to zero.
> 
> This change is not sufficient and causes some cleanup to happen twice
> thus introducing some bugs that weren't there before.
> So take another look.
> 
> > 
> > Fixes: 2c99f1a09da3d ("iio: trigger: clean up viio_trigger_alloc()")
> > 
> No blank line here.  Scripts that commonly run on the kernel tree rely
> on the the tags block having no blank lines in it to avoid false positives.
> 
Hi Jonathan,

Thanks for the review!

You're right – my patch was incomplete and can lead to double cleanup
between the error path and iio_trig_release(). I'll rework the error
handling so that once device_initialize() has been called, all cleanup
goes through put_device(), and resource freeing is centralized in the
release callback.

I’ll send a v2 fixing the double-free issue, showing the error path 
and correcting the Fixes tag format.

Thanks!
Salah