Re: [PATCH v2] iio: buffer: hw-consumer: fix use-after-free in error path

[Andy Shevchenko]

On Thu, Apr 30, 2026 at 09:29:06PM +0800, Felix Gu wrote:
> In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code
> was using list_for_each_entry() to iterate through buffers while calling
> iio_buffer_put() which can free the current buffer if refcount drops to 0.
> The list_for_each_entry() loop macro then evaluates buf->head.next to
> continue iteration, accessing the freed buffer.
> 
> Fix this by using list_for_each_entry_safe().

Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxx>

-- 
With Best Regards,
Andy Shevchenko