Re: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor
Jiri Kosina <[email protected]>
| Newsgroups | org.kernel.vger.linux-iio,org.kernel.vger.linux-input,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 7 Jul 2026, Haoxiang Li wrote: > enable_sensor_store() can call set_power_report_state(), which > dereferences sensor_inst->power_state and sensor_inst->report_state. > These pointers refer to entries in sensor_inst->fields. > > Create the field attributes before exposing the enable_sensor sysfs > attribute, so enable_sensor cannot be accessed before the state it > depends on has been initialized. > > On remove, delete enable_sensor before freeing the field attributes, > so a concurrent sysfs write cannot dereference freed memory through > power_state or report_state. > > Reported-by: Sashiko AI Review <[email protected]> > Link: https://sashiko.dev/#/patchset/[email protected]?part=1 > Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support") > Cc: [email protected] > Signed-off-by: Haoxiang Li <[email protected]> Applied, thanks. -- Jiri Kosina SUSE Labs