[PATCH] iio: buffer: fix bounce buffer use-after-free on unregister

[Nuno Sá]

The bounce buffer used by iio_push_to_buffers_with_ts_unaligned() is
allocated with devm_krealloc() against the IIO device itself. Since
commit 699fb50d9903 ("drivers: base: Free devm resources when
unregistering a device"), device_del() releases the devres of devices
without a bound driver, so the bounce buffer is now freed from
cdev_device_del() in iio_device_unregister().

At that point buffering may still be enabled, as
iio_disable_all_buffers() only runs afterwards. A trigger handler
firing in that window copies the sample into the freed bounce buffer
and pushes it to the buffers.

To fix it, allocate the bounce buffer with plain krealloc() and free it
in iio_dev_release().

Assisted-by: LLM
Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Nuno Sá <nuno.sa@xxxxxxxxxx>
---
Found this by accident and do note this is just code inspection. 

I tagged the original commit supporting the bounce_buffer in Fixes: but
to be fair, the original commit was fine. Tagging 699fb50d9903 also
looks bit odd but maybe it's the real one to blame?
---
 drivers/iio/industrialio-buffer.c | 6 ++----
 drivers/iio/industrialio-core.c   | 1 +
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 4294101810fd..cc5fde0f5191 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -2464,10 +2464,8 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
 	if (iio_dev_opaque->bounce_buffer_size !=  indio_dev->scan_bytes) {
 		void *bb;
 
-		bb = devm_krealloc(&indio_dev->dev,
-				   iio_dev_opaque->bounce_buffer,
-				   indio_dev->scan_bytes,
-				   GFP_KERNEL | __GFP_ZERO);
+		bb = krealloc(iio_dev_opaque->bounce_buffer,
+			      indio_dev->scan_bytes, GFP_KERNEL | __GFP_ZERO);
 		if (!bb)
 			return -ENOMEM;
 		iio_dev_opaque->bounce_buffer = bb;
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 825cf7f32059..ed097eb8d799 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1727,6 +1727,7 @@ static void iio_dev_release(struct device *device)
 	lockdep_unregister_key(&iio_dev_opaque->mlock_key);
 
 	ida_free(&iio_ida, iio_dev_opaque->id);
+	kfree(iio_dev_opaque->bounce_buffer);
 	kfree(iio_dev_opaque);
 }
 

---
base-commit: 20ce8ef9c9e04cd6c5ae0422e251a9b5936c6b7c
change-id: 20261106-iio-fix-possible-uaf-853ce6ff96bc
--

Thanks!
- Nuno Sá