summaryrefslogtreecommitdiff
path: root/drivers/iio/iio_core.h
diff options
context:
space:
mode:
authorAlexandru Ardelean <ardeleanalex@gmail.com>2021-03-07 20:54:44 +0200
committerJonathan Cameron <Jonathan.Cameron@huawei.com>2021-03-25 19:13:51 +0000
commit218bc53dc70022ac31381b43c82f4097a95b8605 (patch)
tree9cf1f0b855ba0b93c65800240f9dcbe48fb11163 /drivers/iio/iio_core.h
parent4f2d9cced4c1ccda7ca0c888892954361c8a397e (diff)
iio: buffer: fix use-after-free for attached_buffers array
Thanks to Lars for finding this. The free of the 'attached_buffers' array should be done as late as possible. This change moves it to iio_buffers_put(), which looks like the best place for it, since it takes place right before the IIO device data is free'd. The free of this array will be handled by calling iio_device_free(). The iio_buffers_put() function is renamed to iio_device_detach_buffers() since the role of this function changes a bit. It looks like this issue was ocurring on the error path of iio_buffers_alloc_sysfs_and_mask() and in iio_buffers_free_sysfs_and_mask() Added a comment in the doc-header of iio_device_attach_buffer() to mention how this will be free'd in case anyone is reading the code and becoming confused about it. Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers") Reported-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com> Link: https://lore.kernel.org/r/20210307185444.32924-1-ardeleanalex@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Diffstat (limited to 'drivers/iio/iio_core.h')
-rw-r--r--drivers/iio/iio_core.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/iio/iio_core.h b/drivers/iio/iio_core.h
index 062fe16c6c49..8f4a9b264962 100644
--- a/drivers/iio/iio_core.h
+++ b/drivers/iio/iio_core.h
@@ -77,7 +77,7 @@ void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev);
void iio_disable_all_buffers(struct iio_dev *indio_dev);
void iio_buffer_wakeup_poll(struct iio_dev *indio_dev);
-void iio_buffers_put(struct iio_dev *indio_dev);
+void iio_device_detach_buffers(struct iio_dev *indio_dev);
#else
@@ -93,7 +93,7 @@ static inline void iio_buffers_free_sysfs_and_mask(struct iio_dev *indio_dev) {}
static inline void iio_disable_all_buffers(struct iio_dev *indio_dev) {}
static inline void iio_buffer_wakeup_poll(struct iio_dev *indio_dev) {}
-static inline void iio_buffers_put(struct iio_dev *indio_dev) {}
+static inline void iio_device_detach_buffers(struct iio_dev *indio_dev) {}
#endif