• David Lechner's avatar
    iio: triggered-buffer: prevent possible freeing of wrong buffer · bce61476
    David Lechner authored
    Commit ee708e6b ("iio: buffer: introduce support for attaching more
    IIO buffers") introduced support for multiple buffers per indio_dev but
    left indio_dev->buffer for a few legacy use cases.
    
    In the case of the triggered buffer, iio_triggered_buffer_cleanup()
    still assumes that indio_dev->buffer points to the buffer allocated by
    iio_triggered_buffer_setup_ext(). However, since
    iio_triggered_buffer_setup_ext() now calls iio_device_attach_buffer()
    to attach the buffer, indio_dev->buffer will only point to the buffer
    allocated by iio_device_attach_buffer() if it the first buffer attached.
    
    This adds a check to make sure that no other buffer has been attached
    yet to ensure that indio_dev->buffer will be assigned when
    iio_device_attach_buffer() is called.
    
    As per discussion in the review thread, we may want to deal with multiple
    triggers per device, but this is a fix for the issue in the meantime and
    any such support would be unlikely to be suitable for a backport.
    
    Fixes: ee708e6b ("iio: buffer: introduce support for attaching more IIO buffers")
    Signed-off-by: default avatarDavid Lechner <dlechner@baylibre.com>
    Acked-by: default avatarNuno Sa <nuno.sa@analog.com>
    Link: https://lore.kernel.org/r/20231031210521.1661552-1-dlechner@baylibre.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
    bce61476
industrialio-triggered-buffer.c 4.15 KB