* [PATCH] iio: trigger: sysfs: fix use-after-free on remove
@ 2022-05-19 9:19 Vincent Whitchurch
2022-05-19 9:58 ` Lars-Peter Clausen
0 siblings, 1 reply; 3+ messages in thread
From: Vincent Whitchurch @ 2022-05-19 9:19 UTC (permalink / raw
To: Jonathan Cameron
Cc: kernel, Vincent Whitchurch, Lars-Peter Clausen, linux-iio,
linux-kernel
Ensure that the irq_work has completed before the trigger is freed.
==================================================================
BUG: KASAN: use-after-free in irq_work_run_list
Read of size 8 at addr 0000000064702248 by task python3/25
Call Trace:
irq_work_run_list
irq_work_tick
update_process_times
tick_sched_handle
tick_sched_timer
__hrtimer_run_queues
hrtimer_interrupt
Allocated by task 25:
kmem_cache_alloc_trace
iio_sysfs_trig_add
dev_attr_store
sysfs_kf_write
kernfs_fop_write_iter
new_sync_write
vfs_write
ksys_write
sys_write
Freed by task 25:
kfree
iio_sysfs_trig_remove
dev_attr_store
sysfs_kf_write
kernfs_fop_write_iter
new_sync_write
vfs_write
ksys_write
sys_write
==================================================================
Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
---
drivers/iio/trigger/iio-trig-sysfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
index 2a4b75897910..3d911c24b265 100644
--- a/drivers/iio/trigger/iio-trig-sysfs.c
+++ b/drivers/iio/trigger/iio-trig-sysfs.c
@@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
}
iio_trigger_unregister(t->trig);
+ irq_work_sync(&t->work);
iio_trigger_free(t->trig);
list_del(&t->l);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove
2022-05-19 9:19 [PATCH] iio: trigger: sysfs: fix use-after-free on remove Vincent Whitchurch
@ 2022-05-19 9:58 ` Lars-Peter Clausen
2022-05-22 11:04 ` Jonathan Cameron
0 siblings, 1 reply; 3+ messages in thread
From: Lars-Peter Clausen @ 2022-05-19 9:58 UTC (permalink / raw
To: Vincent Whitchurch, Jonathan Cameron; +Cc: kernel, linux-iio, linux-kernel
On 5/19/22 11:19, Vincent Whitchurch wrote:
> [...]
>
>
> Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
> Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Thanks for the patch!
Strictly speaking the Fixes: should be
f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly
active trigger")
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
> ---
> drivers/iio/trigger/iio-trig-sysfs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
> index 2a4b75897910..3d911c24b265 100644
> --- a/drivers/iio/trigger/iio-trig-sysfs.c
> +++ b/drivers/iio/trigger/iio-trig-sysfs.c
> @@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
> }
>
> iio_trigger_unregister(t->trig);
> + irq_work_sync(&t->work);
> iio_trigger_free(t->trig);
>
> list_del(&t->l);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove
2022-05-19 9:58 ` Lars-Peter Clausen
@ 2022-05-22 11:04 ` Jonathan Cameron
0 siblings, 0 replies; 3+ messages in thread
From: Jonathan Cameron @ 2022-05-22 11:04 UTC (permalink / raw
To: Lars-Peter Clausen; +Cc: Vincent Whitchurch, kernel, linux-iio, linux-kernel
On Thu, 19 May 2022 11:58:03 +0200
Lars-Peter Clausen <lars@metafoo.de> wrote:
> On 5/19/22 11:19, Vincent Whitchurch wrote:
> > [...]
> >
> >
> > Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
> > Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
>
> Thanks for the patch!
>
> Strictly speaking the Fixes: should be
>
> f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly
> active trigger")
>
>
> Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
I've changed the fixes tag and applied to the fixes-togreg branch of iio.git.
Thanks,
Jonathan
>
> > ---
> > drivers/iio/trigger/iio-trig-sysfs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
> > index 2a4b75897910..3d911c24b265 100644
> > --- a/drivers/iio/trigger/iio-trig-sysfs.c
> > +++ b/drivers/iio/trigger/iio-trig-sysfs.c
> > @@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
> > }
> >
> > iio_trigger_unregister(t->trig);
> > + irq_work_sync(&t->work);
> > iio_trigger_free(t->trig);
> >
> > list_del(&t->l);
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-22 10:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-05-19 9:19 [PATCH] iio: trigger: sysfs: fix use-after-free on remove Vincent Whitchurch
2022-05-19 9:58 ` Lars-Peter Clausen
2022-05-22 11:04 ` Jonathan Cameron
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.