Re: [PATCH] iio: accel: kxsd9: Fix potential use-after-free on removal

[Jonathan Cameron]

On Sat, 31 Oct 2026 21:05:38 +0800
Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx> wrote:

> Unregistering an IIO device with an active triggered buffer detaches its
> poll function. Freeing the poll function first can therefore make
> iio_device_unregister() access freed memory.
> 
> Unregister the device before cleaning up the triggered buffer.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 0427a106a98a ("iio: accel: kxsd9: Add triggered buffer handling")
> Assisted-by: OpenAI:gpt-6-astra
> Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
Applied with tag dropped as Joshua pointed out and with stable added.

Thanks,

Jonathan

> ---
> Build-tested the changed object with x86_64 allmodconfig (W=1,
> CONFIG_WERROR=n).
> No runtime or fault-injection testing was performed.
> 
>  drivers/iio/accel/kxsd9.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
> index 7ac885d94d7f..27adcdd31201 100644
> --- a/drivers/iio/accel/kxsd9.c
> +++ b/drivers/iio/accel/kxsd9.c
> @@ -478,8 +478,8 @@ void kxsd9_common_remove(struct device *dev)
>  	struct iio_dev *indio_dev = dev_get_drvdata(dev);
>  	struct kxsd9_state *st = iio_priv(indio_dev);
>  
> -	iio_triggered_buffer_cleanup(indio_dev);
>  	iio_device_unregister(indio_dev);
> +	iio_triggered_buffer_cleanup(indio_dev);
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> 
> base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
>