kthread_run() can fail and return an error pointer, but sgp_probe() stores
it and returns success, so the device is registered without its IAQ thread
and sgp_remove() later passes the error pointer to kthread_stop(). Return
the error from probe instead.

Fixes: ce514124161a ("iio: chemical: sgp30: Support Sensirion SGP30/SGPC3 sensors")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/iio/chemical/sgp30.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/chemical/sgp30.c b/drivers/iio/chemical/sgp30.c
index f10bbebc29e4..379c1c4af8d8 100644
--- a/drivers/iio/chemical/sgp30.c
+++ b/drivers/iio/chemical/sgp30.c
@@ -548,6 +548,9 @@ static int sgp_probe(struct i2c_client *client)
 
 	data->iaq_thread = kthread_run(sgp_iaq_threadfn, data,
 				       "%s-iaq", data->client->name);
+	if (IS_ERR(data->iaq_thread))
+		return dev_err_probe(dev, PTR_ERR(data->iaq_thread),
+				     "failed to start IAQ thread\n");
 
 	return 0;
 }
-- 
2.25.1

On Wed, 22 Jul 2026 15:48:37 +0800
Linmao Li <lilinmao@kylinos.cn> wrote:

> kthread_run() can fail and return an error pointer, but sgp_probe() stores
> it and returns success, so the device is registered without its IAQ thread
> and sgp_remove() later passes the error pointer to kthread_stop(). Return
> the error from probe instead.
> 
> Fixes: ce514124161a ("iio: chemical: sgp30: Support Sensirion SGP30/SGPC3 sensors")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---
>  drivers/iio/chemical/sgp30.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/iio/chemical/sgp30.c b/drivers/iio/chemical/sgp30.c
> index f10bbebc29e4..379c1c4af8d8 100644
> --- a/drivers/iio/chemical/sgp30.c
> +++ b/drivers/iio/chemical/sgp30.c
> @@ -548,6 +548,9 @@ static int sgp_probe(struct i2c_client *client)
>  
>  	data->iaq_thread = kthread_run(sgp_iaq_threadfn, data,
>  				       "%s-iaq", data->client->name);
> +	if (IS_ERR(data->iaq_thread))
> +		return dev_err_probe(dev, PTR_ERR(data->iaq_thread),
> +				     "failed to start IAQ thread\n");
>  
>  	return 0;
>  }

Good catch! This should also be marked for stable, perhaps Jonathan
can do that while applying.

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts