Description
In the Linux kernel, the following vulnerability has been resolved: iio: mma8452: Fix trigger reference couting The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ae6d9ce05691bf79694074db7c7da980080548af to < 094d513b78b1714113bc016684b8142382e071baaffectedae6d9ce05691bf79694074db7c7da980080548af to < fb75cc4740d81264cd5bcb0e17d961d018a8be96affectedae6d9ce05691bf79694074db7c7da980080548af to < 794c0898f6bf39a458655d5fb4af70ec43a5cfcbaffectedae6d9ce05691bf79694074db7c7da980080548af to < f5deab10ced368c807866283f8b79144c4823be8affectedae6d9ce05691bf79694074db7c7da980080548af to < acf0088ac073ca6e7f4cad6acac112177e08df5eaffectedae6d9ce05691bf79694074db7c7da980080548af to < db12d95085367de8b0223929d1332731024441f1affectedae6d9ce05691bf79694074db7c7da980080548af to < c43517071dfc9fce34f8f69dbb98a86017f6b739affectedae6d9ce05691bf79694074db7c7da980080548af to < cd0082235783f814241a1c9483fb89e405f4f892affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected4.4.295 to ≤ 4.4.*unaffected4.9.293 to ≤ 4.9.*unaffected4.14.258 to ≤ 4.14.*unaffected4.19.221 to ≤ 4.19.*unaffected5.4.165 to ≤ 5.4.*unaffected5.10.85 to ≤ 5.10.*unaffected5.15.8 to ≤ 5.15.*unaffected5.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/094d513b78b1714113bc016684b8142382e071ba ↗
- https://git.kernel.org/stable/c/fb75cc4740d81264cd5bcb0e17d961d018a8be96 ↗
- https://git.kernel.org/stable/c/794c0898f6bf39a458655d5fb4af70ec43a5cfcb ↗
- https://git.kernel.org/stable/c/f5deab10ced368c807866283f8b79144c4823be8 ↗
- https://git.kernel.org/stable/c/acf0088ac073ca6e7f4cad6acac112177e08df5e ↗
- https://git.kernel.org/stable/c/db12d95085367de8b0223929d1332731024441f1 ↗
- https://git.kernel.org/stable/c/c43517071dfc9fce34f8f69dbb98a86017f6b739 ↗
- https://git.kernel.org/stable/c/cd0082235783f814241a1c9483fb89e405f4f892 ↗