CVE-2026-98677: iio: adc: ad_sigma_delta: fix use-after-free on unbind
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: adsigmadelta: fix use-after-free on unbind
adsdbufferpostenable() allocates sigmadelta->samplesbuf with devmkrealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samplesbuf before iiodeviceunregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, so adsdtriggerhandler() can still run and memcpy() incoming samples into the freed samplesbuf.
Fix this by preallocating the buffer in devmadsdsetupbufferandtrigger(), before the triggered buffer and the IRQ are set up, so it is freed only after iiodeviceunregister() has drained the trigger handler via freeirq(). Size it for the worst case of all sequencer slots being active; adsdvalidatescanmask() already caps the number of active channels at numslots.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Preallocate sigma_delta->samples_buf during probe/setup for the worst case of all sequencer slots being active, instead of using devm_krealloc() at runtime, so the buffer remains valid until after iio_device_unregister() has disabled buffers and detached the trigger.