diff options
| author | Fan Wu <fanwu01@zju.edu.cn> | 2026-08-06 14:25:02 +0000 |
|---|---|---|
| committer | Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> | 2026-08-31 00:52:42 +0100 |
| commit | 2a57b9246cecd5dd797a42eb310d6c8816f26d9e (patch) | |
| tree | d20ffc9caa070c92929ae4a34a3a4005a128f509 /tools/lib/python/kdoc/python_version.py | |
| parent | 2093236e886ad9446ec3285ba520e024dd1464e1 (diff) | |
| download | linux-next-2a57b9246cecd5dd797a42eb310d6c8816f26d9e.tar.gz linux-next-2a57b9246cecd5dd797a42eb310d6c8816f26d9e.zip | |
iio: trigger: cancel reenable_work before freeing trigger
iio_trigger_notify_done_atomic() defers ->reenable() into
trig->reenable_work on the system workqueue, and the worker dereferences
the owning trigger through container_of(). Nothing cancels this work
before iio_trig_release() frees the trigger, so a worker armed by the
last in-flight IRQ can outlive the free and touch freed memory.
Cancel it at the top of iio_trig_release(), which every free path
reaches through the device core's final put_device().
Found by an in-house static analysis tool.
Fixes: 9020ef659885 ("iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions