Fan Wu 9ee8306121 iio: adc: ad_sigma_delta: fix use-after-free on unbind ...

ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with
devm_krealloc() at runtime, so its devres entry sits after all
probe-time entries of the driver. devm resources are released in
reverse allocation order, which means unbind frees samples_buf before
iio_device_unregister() disables the buffers and detaches the trigger
pollfunc. The data ready IRQ is still enabled at that point, so
ad_sd_trigger_handler() can still run and memcpy() incoming samples
into the freed samples_buf.

Fix this by preallocating the buffer in
devm_ad_sd_setup_buffer_and_trigger(), before the triggered buffer and
the IRQ are set up, so it is freed only after iio_device_unregister()
has drained the trigger handler via free_irq(). Size it for the worst
case of all sequencer slots being active; ad_sd_validate_scan_mask()
already caps the number of active channels at num_slots.

This issue was found by an in-house static analysis tool.

Fixes: 8bea9af887 ("iio: adc: ad_sigma_delta: Add sequencer support")
Cc: [email protected]
Co-developed-by: Song Li <[email protected]>
Signed-off-by: Song Li <[email protected]>
Signed-off-by: Fan Wu <[email protected]>
Reviewed-by: Nuno Sá <[email protected]>
Signed-off-by: Jonathan Cameron <[email protected]>

2026-09-30 18:59:56 +01:00

..

88pm886-gpadc.c

iio: adc: make read-only const array config static

2026-07-20 02:43:15 +01:00

ab8500-gpadc.c

…

ad799x.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ad4000.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad4030.c

iio: adc: ad4030: fix invalid oversampling_ratio validation

2026-09-30 18:59:55 +01:00

ad4062.c

iio: adc: ad4062: use dev_err_probe()

2026-04-27 09:58:18 +01:00

ad4080.c

Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2026-08-19 09:45:01 +02:00

ad4130.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad4134.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad4170-4.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad4691.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ad4695.c

iio: adc: ad4695: Fix call ordering in offload buffer postenable

2026-04-28 16:36:09 +01:00

ad4851.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7091r5.c

iio: adc: ad7091r5: Simplify driver_data handling

2026-05-31 11:01:46 +01:00

ad7091r8.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7091r-base.c

…

ad7091r-base.h

…

ad7124.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7173.c

iio: adc: ad7173: Fix digital filter configuration

2026-09-30 18:59:55 +01:00

ad7191.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7192.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7266.c

iio: Drop unused assignment of spi_device_id driver data

2026-06-30 00:15:56 +01:00

ad7280a.c

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

ad7291.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ad7292.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7298.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7380.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7405.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ad7476.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7606_bus_iface.h

…

ad7606_par.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ad7606_spi.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7606.c

iio: Convert IIO_CHAN_SOFT_TIMESTAMP() to be compound literal

2026-05-31 11:01:48 +01:00

ad7606.h

…

ad7625.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ad7766.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7768-1.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7779.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ad7780.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7791.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7793.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7887.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7923.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7944.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad7949.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad9467.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ad_sigma_delta.c

iio: adc: ad_sigma_delta: fix use-after-free on unbind

2026-09-30 18:59:56 +01:00

ade9000.c

iio: adc: ade9000: fix NULL pointer dereference in clkout registration

2026-09-30 18:59:55 +01:00

adi-axi-adc.c

iio: adc: adi-axi-adc: Initialize state mutex

2026-08-31 00:52:40 +01:00

aspeed_adc.c

iio: adc: aspeed: propagate reset deassert errors

2026-08-31 00:52:42 +01:00

at91_adc.c

iio: adc: at91_adc: use const char * for DT string property

2026-07-27 22:13:07 +01:00

at91-sama5d2_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

axp20x_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

axp288_adc.c

iio: adc: axp288: Add TS bias override for Haier HV103H

2026-09-05 02:44:00 +01:00

bcm_iproc_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

berlin2-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

cc10001_adc.c

iio: adc: cc10001_adc: simplify timestamp channel definition

2026-05-31 11:01:49 +01:00

cpcap-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

da9150-gpadc.c

…

dln2-adc.c

iio: adc: dln2-adc: simplify timestamp channel definition

2026-05-31 11:01:48 +01:00

envelope-detector.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ep93xx_adc.c

…

exynos_adc.c

…

fsl-imx25-gcq.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

gehc-pmc-adc.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

hi8435.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

hx711.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

imx7d_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

imx8qxp-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

imx93_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ina2xx-adc.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

industrialio-adc.c

…

ingenic-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

intel_dc_ti_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

intel_mrfld_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

Kconfig

Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2026-08-19 09:45:01 +02:00

lp8788_adc.c

…

lpc18xx_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

lpc32xx_adc.c

Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-07-12 12:37:28 -07:00

ltc2309.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ltc2378.c

iio: adc: ltc2378: Add support for LTC2338-18

2026-08-03 22:32:33 +01:00

ltc2471.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ltc2485.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ltc2496.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ltc2497-core.c

…

ltc2497.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ltc2497.h

…

Makefile

iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs

2026-08-03 22:32:33 +01:00

max1027.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

max1118.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

max1241.c

iio: adc: max1241: add missing MODULE_DEVICE_TABLE()

2026-07-05 00:57:10 +01:00

max1363.c

iio: adc: max1363: sign-extend bipolar differential channel reads

2026-08-31 00:52:40 +01:00

max9611.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

max11100.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

max11205.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

max11410.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

max14001.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

max34408.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

max77541-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mcp320x.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

mcp3422.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mcp3564.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

mcp3911.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

men_z188_adc.c

…

meson_saradc.c

iio: adc: meson-saradc: fix calibration buffer leak on error

2026-05-15 12:05:34 +01:00

mp2629_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mt6323-auxadc.c

iio: adc: mt6323: remove unused header

2026-07-13 01:32:46 +01:00

mt6359-auxadc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mt6360-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mt6370-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mt6577_auxadc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mxs-lradc-adc.c

…

nau7802.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

nct7201.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

npcm_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

nxp-sar-adc.c

Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-07-12 12:37:28 -07:00

pac1921.c

iio: adc: pac1921: fix wrong channel used in trigger handler read

2026-08-07 23:51:05 +01:00

pac1934.c

iio: adc: pac1934: check ACPI label duplication

2026-09-21 00:58:42 +01:00

palmas_gpadc.c

…

qcom-pm8xxx-xoadc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

qcom-spmi-adc5-gen3.c

iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driver

2026-08-07 17:18:44 +02:00

qcom-spmi-adc5.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

qcom-spmi-iadc.c

iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind

2026-05-26 19:22:57 +01:00

qcom-spmi-rradc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

qcom-spmi-vadc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

qcom-vadc-common.c

…

rcar-gyroadc.c

iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper

2026-08-03 22:32:32 +01:00

rn5t618-adc.c

…

rockchip_saradc.c

…

rohm-bd79112.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

rohm-bd79124.c

iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop

2026-08-31 00:52:40 +01:00

rtq6056.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

rzg2l_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

rzn1-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

rzt2h_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

sc27xx_adc.c

…

sd_adc_modulator.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

sophgo-cv1800b-adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

spear_adc.c

Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-07-12 12:37:28 -07:00

stm32-adc-core.c

…

stm32-adc-core.h

…

stm32-adc.c

iio: adc: stm32-adc: fix possible division by zero in processed channel

2026-09-30 18:59:55 +01:00

stm32-dfsdm-adc.c

iio: stm32-dfsdm: Treat flags as booleans

2026-06-30 00:15:53 +01:00

stm32-dfsdm-core.c

…

stm32-dfsdm.h

…

stmpe-adc.c

…

sun4i-gpadc-iio.c

iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure

2026-09-06 18:35:10 +01:00

sun20i-gpadc-iio.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ti_am335x_adc.c

iio: adc: add an article and use digitize instead of digitalize

2026-03-21 19:13:12 +00:00

ti-adc081c.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc084s021.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc108s102.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc128s052.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc161s626.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc0832.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-adc12138.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ti-ads112c14.c

iio: adc: ti-ads112c14: add support for buffered read

2026-08-03 22:32:31 +01:00

ti-ads124s08.c

Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2026-08-19 09:45:01 +02:00

ti-ads131e08.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ti-ads131m02.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-ads1015.c

iio: adc: ti-ads1015: use devm helpers to fix probe error paths

2026-07-04 00:07:34 +01:00

ti-ads1018.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-ads1100.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ti-ads1119.c

iio: adc: ti-ads1119: fix PM reference leak in buffer preenable

2026-06-29 23:24:45 +01:00

ti-ads1298.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ti-ads7138.c

iio: ti-ads7138: Disable STATS_EN bit while reading conversion results

2026-08-07 23:49:34 +01:00

ti-ads7924.c

iio: Initialize i2c_device_id arrays using member names

2026-05-31 11:01:46 +01:00

ti-ads7950.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ti-ads8344.c

…

ti-ads8688.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-lmp92064.c

iio: Initialize spi_device_id arrays using member names

2026-06-30 00:15:56 +01:00

ti-tlc4541.c

Merge tag 'v7.2-rc2' into togreg

2026-07-06 16:59:47 +01:00

ti-tsc2046.c

iio: adc: ti-tsc2046: Simplify device handling

2026-07-01 18:38:38 +01:00

twl4030-madc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

twl6030-gpadc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

versal-sysmon-core.c

iio: adc: versal-sysmon: add oversampling support

2026-07-02 16:43:51 +01:00

versal-sysmon-i2c.c

iio: adc: versal-sysmon: add I2C driver

2026-07-02 16:43:51 +01:00

versal-sysmon.c

iio: adc: add Versal SysMon driver

2026-07-02 16:43:51 +01:00

versal-sysmon.h

iio: adc: versal-sysmon: add oversampling support

2026-07-02 16:43:51 +01:00

vf610_adc.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

viperboard_adc.c

iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw

2026-05-15 12:05:35 +01:00

xilinx-ams.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

xilinx-xadc-core.c

iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

2026-08-31 00:52:41 +01:00

xilinx-xadc-events.c

…

xilinx-xadc.h

…