Tzung-Bi Shih 569a126f24 iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() ... [ Upstream commit 7771c8c80d ] cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and calls iio_push_to_buffers_with_timestamp() without making sure the `indio_dev` stays in buffer mode. There is a race if `indio_dev` exits buffer mode right before cros_ec_sensors_push_data() accesses them. An use-after-free on `indio_dev->active_scan_mask` was observed. The call trace: [...] _find_next_bit cros_ec_sensors_push_data cros_ec_sensorhub_event blocking_notifier_call_chain cros_ec_irq_thread It was caused by a race condition: one thread just freed `active_scan_mask` at [1]; while another thread tried to access the memory at [2]. Fix it by calling iio_device_claim_buffer_mode() to ensure the `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data(). [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189 [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198 Cc: stable@vger.kernel.org Fixes: aa984f1ba4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO") Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230829030622.1571852-1-tzungbi@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-10-25 11:58:58 +02:00
..
cros_ec_sensors	iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()	2023-10-25 11:58:58 +02:00
hid-sensors	iio/drivers/hid-sensor: use HZ macros	2021-09-08 11:50:26 -07:00
ms_sensors	iio:common:ms_sensors:ms_sensors_i2c: add support for alternative PROM layout	2021-01-22 08:52:07 +00:00
scmi_sensors	iio: scmi: fix spelling of SPDX tag	2021-06-13 17:00:18 +01:00
ssp_sensors	iio: ssp_sensors: add more range checking in ssp_parse_dataframe()	2021-09-18 19:10:55 +01:00
st_sensors	iio: st_sensors: Add a local lock for protecting odr	2022-06-14 18:36:20 +02:00
Kconfig	iio/scmi: Adding support for IIO SCMI Based Sensors	2021-03-13 16:43:04 +00:00
Makefile	iio/scmi: Adding support for IIO SCMI Based Sensors	2021-03-13 16:43:04 +00:00