mpu3050_trigger_probe() allocates the DRDY trigger with
devm_iio_trigger_alloc() but registers it with plain
iio_trigger_register(). The remove callback calls free_irq()
on the trigger but never calls iio_trigger_unregister(), so on
module unload the trigger remains in the global trigger list
while its memory is freed by devm, leaving a dangling entry.

Switch to devm_iio_trigger_register() so the registration is
undone automatically in the same devm scope as the allocation.

Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: stable@vger.kernel.org
Signed-off-by: Li Xinyu <xinyuili@126.com>
---
Changes in v2:
- Corrected the name format in Signed-off-by from "lixinyu" to proper
  "Li Xinyu". Sorry for the mistake in v1. Thank you Maxime.
---
 drivers/iio/gyro/mpu3050-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index d84e04e4b431..bcfa83a46737 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1127,7 +1127,7 @@ static int mpu3050_trigger_probe(struct iio_dev *indio_dev, int irq)
 	mpu3050->trig->ops = &mpu3050_trigger_ops;
 	iio_trigger_set_drvdata(mpu3050->trig, indio_dev);
 
-	ret = iio_trigger_register(mpu3050->trig);
+	ret = devm_iio_trigger_register(mpu3050->dev, mpu3050->trig);
 	if (ret)
 		goto err_iio_trigger;
 
-- 
2.34.1

On Wed, 20 May 2026 11:24:47 +0800
Li Xinyu <xinyuili@126.com> wrote:

> mpu3050_trigger_probe() allocates the DRDY trigger with
> devm_iio_trigger_alloc() but registers it with plain
> iio_trigger_register(). The remove callback calls free_irq()
> on the trigger but never calls iio_trigger_unregister(), so on
> module unload the trigger remains in the global trigger list
> while its memory is freed by devm, leaving a dangling entry.
> 
> Switch to devm_iio_trigger_register() so the registration is
> undone automatically in the same devm scope as the allocation.
> 
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li Xinyu <xinyuili@126.com>
Look at the more general use of devm in this driver.

The rule of thumb for devm is that you can only use it from start of
probe() to the point where you first make a call that doesn't use it.
After that you must not use any devm calls.

Sometimes it is easy to use it for all of probe() which obviously obeys
that rule.

Also when you do switch to devm in a driver, there is normally a
reverse operation to remove in remove() and error paths().

There was a recent fix for a case similar to this but that was because
that driver did everything else with devm and didn't call the unwind
at all. It was a simple typo in the driver.

Jonathan


> ---
> Changes in v2:
> - Corrected the name format in Signed-off-by from "lixinyu" to proper
>   "Li Xinyu". Sorry for the mistake in v1. Thank you Maxime.
> ---
>  drivers/iio/gyro/mpu3050-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
> index d84e04e4b431..bcfa83a46737 100644
> --- a/drivers/iio/gyro/mpu3050-core.c
> +++ b/drivers/iio/gyro/mpu3050-core.c
> @@ -1127,7 +1127,7 @@ static int mpu3050_trigger_probe(struct iio_dev *indio_dev, int irq)
>  	mpu3050->trig->ops = &mpu3050_trigger_ops;
>  	iio_trigger_set_drvdata(mpu3050->trig, indio_dev);
>  
> -	ret = iio_trigger_register(mpu3050->trig);
> +	ret = devm_iio_trigger_register(mpu3050->dev, mpu3050->trig);
>  	if (ret)
>  		goto err_iio_trigger;
>