2022-05-19 15:35:50

by Lars-Peter Clausen

Subject: Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove

On 5/19/22 11:19, Vincent Whitchurch wrote:
> [...]
>
>
> Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
> Signed-off-by: Vincent Whitchurch <[email protected]>

Thanks for the patch!

Strictly speaking the Fixes: should be

f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly
active trigger")


Reviewed-by: Lars-Peter Clausen <[email protected]>

> ---
> drivers/iio/trigger/iio-trig-sysfs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
> index 2a4b75897910..3d911c24b265 100644
> --- a/drivers/iio/trigger/iio-trig-sysfs.c
> +++ b/drivers/iio/trigger/iio-trig-sysfs.c
> @@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
> }
>
> iio_trigger_unregister(t->trig);
> + irq_work_sync(&t->work);
> iio_trigger_free(t->trig);
>
> list_del(&t->l);

2022-05-23 07:33:45

by Jonathan Cameron

Subject: Re: [PATCH] iio: trigger: sysfs: fix use-after-free on remove

On Thu, 19 May 2022 11:58:03 +0200
Lars-Peter Clausen <[email protected]> wrote:

> On 5/19/22 11:19, Vincent Whitchurch wrote:
> > [...]
> >
> >
> > Fixes: e64e7d5c8c86e ("iio:trigger:sysfs Move out of staging.")
> > Signed-off-by: Vincent Whitchurch <[email protected]>
>
> Thanks for the patch!
>
> Strictly speaking the Fixes: should be
>
> f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly
> active trigger")
>
>
> Reviewed-by: Lars-Peter Clausen <[email protected]>
I've changed the fixes tag and applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

>
> > ---
> > drivers/iio/trigger/iio-trig-sysfs.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
> > index 2a4b75897910..3d911c24b265 100644
> > --- a/drivers/iio/trigger/iio-trig-sysfs.c
> > +++ b/drivers/iio/trigger/iio-trig-sysfs.c
> > @@ -191,6 +191,7 @@ static int iio_sysfs_trigger_remove(int id)
> > }
> >
> > iio_trigger_unregister(t->trig);
> > + irq_work_sync(&t->work);
> > iio_trigger_free(t->trig);
> >
> > list_del(&t->l);
>
>