tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc()
but registers it with plain iio_trigger_register(). The driver has no
.remove() callback, so on module unload the trigger stays in the global
trigger list while its memory is freed by devm, leaving a dangling
entry.

Switch to devm_iio_trigger_register() so the registration is undone in
the same devm scope as the allocation.

Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
Cc: stable@vger.kernel.org
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
---
 drivers/iio/temperature/tmp006.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index d8d8c8936..bf62143fa 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -350,7 +350,7 @@ static int tmp006_probe(struct i2c_client *client)
 
 		data->drdy_trig->ops = &tmp006_trigger_ops;
 		iio_trigger_set_drvdata(data->drdy_trig, indio_dev);
-		ret = iio_trigger_register(data->drdy_trig);
+		ret = devm_iio_trigger_register(&client->dev, data->drdy_trig);
 		if (ret)
 			return ret;
 
-- 
2.43.0

On Sun, 17 May 2026 23:26:13 +0500
Stepan Ionichev <sozdayvek@gmail.com> wrote:

> tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc()
> but registers it with plain iio_trigger_register(). The driver has no
> .remove() callback, so on module unload the trigger stays in the global
> trigger list while its memory is freed by devm, leaving a dangling
> entry.
> 
> Switch to devm_iio_trigger_register() so the registration is undone in
> the same devm scope as the allocation.
> 
> Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Looks 'obviously' correct enough that I'll pick it up with the very little time
it's been on list.  If anyone disagrees do shout!

Applied to the fixes-togreg branch of iio.git

Thanks

Jonathan

> ---
>  drivers/iio/temperature/tmp006.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
> index d8d8c8936..bf62143fa 100644
> --- a/drivers/iio/temperature/tmp006.c
> +++ b/drivers/iio/temperature/tmp006.c
> @@ -350,7 +350,7 @@ static int tmp006_probe(struct i2c_client *client)
>  
>  		data->drdy_trig->ops = &tmp006_trigger_ops;
>  		iio_trigger_set_drvdata(data->drdy_trig, indio_dev);
> -		ret = iio_trigger_register(data->drdy_trig);
> +		ret = devm_iio_trigger_register(&client->dev, data->drdy_trig);
>  		if (ret)
>  			return ret;
>