Tzung-Bi Shih 7771c8c80d iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() ... cros_ec_sensors_push_data() reads `indio_dev->active_scan_mask` and calls iio_push_to_buffers_with_timestamp() without making sure the `indio_dev` stays in buffer mode. There is a race if `indio_dev` exits buffer mode right before cros_ec_sensors_push_data() accesses them. An use-after-free on `indio_dev->active_scan_mask` was observed. The call trace: [...] _find_next_bit cros_ec_sensors_push_data cros_ec_sensorhub_event blocking_notifier_call_chain cros_ec_irq_thread It was caused by a race condition: one thread just freed `active_scan_mask` at [1]; while another thread tried to access the memory at [2]. Fix it by calling iio_device_claim_buffer_mode() to ensure the `indio_dev` can't exit buffer mode during cros_ec_sensors_push_data(). [1]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/industrialio-buffer.c#L1189 [2]: https://elixir.bootlin.com/linux/v6.5/source/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c#L198 Cc: stable@vger.kernel.org Fixes: aa984f1ba4 ("iio: cros_ec: Register to cros_ec_sensorhub when EC supports FIFO") Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230829030622.1571852-1-tzungbi@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>		2023-10-05 18:06:45 +01:00
..
cros_ec_lid_angle.c	iio: cros: Register FIFO callback after sensor is registered	2022-07-18 18:29:13 +01:00
cros_ec_sensors.c	iio: cros: Register FIFO callback after sensor is registered	2022-07-18 18:29:13 +01:00
cros_ec_sensors_core.c	iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data()	2023-10-05 18:06:45 +01:00
Kconfig	iio / platform: cros_ec: Add cros-ec-sensorhub driver	2019-11-21 11:23:14 +01:00
Makefile	chrome platform changes for v5.3	2019-07-11 18:45:29 -07:00