Re: [PATCH] platform/x86: toshiba_acpi: fix UAF after IIO registration failure

[Ilpo Järvinen]

On Mon, 26 Oct 2026 16:30:42 +0800, Guangshuo Li wrote:

> When iio_device_register() fails, the error path frees dev->indio_dev
> but leaves the pointer non-NULL. Since the probe continues, a later
> driver removal or a subsequent probe failure can reach
> toshiba_acpi_remove(), which may call iio_device_unregister() and
> iio_device_free() through the dangling pointer.
> 
> Set dev->indio_dev to NULL after freeing it so the remove path skips
> the already-freed IIO device.
> 
> [...]

Thank you for your contribution, it has been applied to my local
review-ilpo-next branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-next branch only once I've pushed my
local branch there, which might take a while.

FYI [if applicable to your patch], as per Linus' policy change, also
fixes are mostly routed through for-next unless the fix is for a
commit introduced in the most recent cycle or is clearly a regression
fix.

The list of commits applied:
[1/1] platform/x86: toshiba_acpi: fix UAF after IIO registration failure
      commit: fec3ad5dd1411c3b05f5ff1ff21a5025a0fd68f6

--
 i.