vl53l0x_trigger_handler() returns directly on the I2C read failure
paths without calling iio_trigger_notify_done() or
vl53l0x_clear_irq():

	ret = i2c_smbus_read_i2c_block_data(...);
	if (ret < 0)
		return ret;
	else if (ret != 12)
		return -EREMOTEIO;

A single transient i2c_smbus_read_i2c_block_data() failure (negative
errno or a short read) therefore leaves two pieces of state behind:

  - iio_trigger_notify_done() never decrements the trigger's use_count,
    so iio_trigger_poll_nested() silently drops further dispatches
    (see industrialio-trigger.c, the !atomic_read(&trig->use_count)
    guard);
  - vl53l0x_clear_irq() never writes SYSTEM_INTERRUPT_CLEAR, so the
    chip keeps the DRDY interrupt asserted.

The sensor's buffer mode stays wedged from then on, recoverable only
by re-binding the driver. The sibling driver vl53l1x-i2c.c handles
exactly the same case correctly by jumping to a "notify_and_clear_irq"
label that always calls both helpers; mirror that here.

The bogus negative-int return value cast to irqreturn_t also goes
away as a side effect.

Fixes: 762186c6e7b1 ("iio: proximity: vl53l0x-i2c: Added continuous mode support")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
---
 drivers/iio/proximity/vl53l0x-i2c.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/proximity/vl53l0x-i2c.c b/drivers/iio/proximity/vl53l0x-i2c.c
index ad3e46d47..7acb94acc 100644
--- a/drivers/iio/proximity/vl53l0x-i2c.c
+++ b/drivers/iio/proximity/vl53l0x-i2c.c
@@ -87,15 +87,14 @@ static irqreturn_t vl53l0x_trigger_handler(int irq, void *priv)
 	ret = i2c_smbus_read_i2c_block_data(data->client,
 					VL_REG_RESULT_RANGE_STATUS,
 					sizeof(buffer), buffer);
-	if (ret < 0)
-		return ret;
-	else if (ret != 12)
-		return -EREMOTEIO;
+	if (ret < 0 || ret != 12)
+		goto done;
 
 	scan.chan = get_unaligned_be16(&buffer[10]);
 	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
 				    iio_get_time_ns(indio_dev));
 
+done:
 	iio_trigger_notify_done(indio_dev->trig);
 	vl53l0x_clear_irq(data);
 
-- 
2.43.0

On Thu, May 14, 2026 at 12:31:19AM +0500, Stepan Ionichev wrote:
> vl53l0x_trigger_handler() returns directly on the I2C read failure
> paths without calling iio_trigger_notify_done() or
> vl53l0x_clear_irq():

> 	ret = i2c_smbus_read_i2c_block_data(...);
> 	if (ret < 0)
> 		return ret;
> 	else if (ret != 12)
> 		return -EREMOTEIO;

Unneeded citation of the code which is visible from the change.

> A single transient i2c_smbus_read_i2c_block_data() failure (negative
> errno or a short read) therefore leaves two pieces of state behind:
> 
>   - iio_trigger_notify_done() never decrements the trigger's use_count,
>     so iio_trigger_poll_nested() silently drops further dispatches
>     (see industrialio-trigger.c, the !atomic_read(&trig->use_count)
>     guard);
>   - vl53l0x_clear_irq() never writes SYSTEM_INTERRUPT_CLEAR, so the
>     chip keeps the DRDY interrupt asserted.
> 
> The sensor's buffer mode stays wedged from then on, recoverable only
> by re-binding the driver. The sibling driver vl53l1x-i2c.c handles
> exactly the same case correctly by jumping to a "notify_and_clear_irq"
> label that always calls both helpers; mirror that here.
> 
> The bogus negative-int return value cast to irqreturn_t also goes
> away as a side effect.

...

> -	else if (ret != 12)
> -		return -EREMOTEIO;
> +	if (ret < 0 || ret != 12)
> +		goto done;

While this magic 12 is in the original code, perhaps a patch on top to make it
use sizeof() instead.

-- 
With Best Regards,
Andy Shevchenko