Re: [PATCH v2] iio: buffer: hw-consumer: fix use-after-free in error path

[Maxwell Doose]

On Thu Apr 30, 2026 at 8:29 AM CDT, Felix Gu wrote:
> In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code
> was using list_for_each_entry() to iterate through buffers while calling
> iio_buffer_put() which can free the current buffer if refcount drops to 0=
.
> The list_for_each_entry() loop macro then evaluates buf->head.next to
> continue iteration, accessing the freed buffer.
>
> Fix this by using list_for_each_entry_safe().
>
> Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support")
> Reported-by: sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647@xxxxxxxxx
> Signed-off-by: Felix Gu <ustc.gu@xxxxxxxxx>
> ---
> Changes in v2:
> - Fix Andy's comment.
> - Add Reported-by tag.
> - Link to v1: https://lore.kernel.org/r/20260428-iio-buf-v1-1-dcc63ff7b80@xxxxxxxxx
> ---
>  drivers/iio/buffer/industrialio-hw-consumer.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>

Looks fine to me.

Reviewed-by: Maxwell Doose <m32285159@xxxxxxxxx>

best regards,
maxwell



> Best regards,
> --=
> Felix Gu <ustc.gu@xxxxxxxxx>