iio: accel: bma400: Fix trigger reference leak in bma400_probe()

[PATCH] iio: accel: bma400: Fix trigger reference leak in bma400_probe()

Posted by Wentao Liang 1 week, 1 day ago

Move indio_dev->trig = iio_trigger_get(data->trig) after the
devm_request_threaded_irq() and triggered buffer setup succeed. If
either fails before INDIO_BUFFER_TRIGGERED is set, the IIO core does
not put the trigger reference in iio_dev_release(), leaking it.

Fixes: ffe0ab6a9698 ("iio: accel: bma400: Add triggered buffer support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/accel/bma400_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
index 05f72707f830..a5889b67585e 100644
--- a/drivers/iio/accel/bma400_core.c
+++ b/drivers/iio/accel/bma400_core.c
@@ -1783,7 +1783,6 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
 			return dev_err_probe(data->dev, ret,
 					     "iio trigger register fail\n");
 
-		indio_dev->trig = iio_trigger_get(data->trig);
 		ret = devm_request_threaded_irq(dev, irq, NULL,
 						&bma400_interrupt,
 						IRQF_TRIGGER_RISING | IRQF_ONESHOT,
@@ -1799,6 +1798,9 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
 		return dev_err_probe(data->dev, ret,
 				     "iio triggered buffer setup failed\n");
 
+	if (irq > 0)
+		indio_dev->trig = iio_trigger_get(data->trig);
+
 	return devm_iio_device_register(dev, indio_dev);
 }
 EXPORT_SYMBOL_NS(bma400_probe, "IIO_BMA400");
-- 
2.34.1

Re: [PATCH] iio: accel: bma400: Fix trigger reference leak in bma400_probe()

Posted by Jonathan Cameron 1 week, 1 day ago

On Wed, 16 Sep 2026 16:08:25 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> Move indio_dev->trig = iio_trigger_get(data->trig) after the
> devm_request_threaded_irq() and triggered buffer setup succeed. If
> either fails before INDIO_BUFFER_TRIGGERED is set, the IIO core does
> not put the trigger reference in iio_dev_release(), leaking it.
> 
> Fixes: ffe0ab6a9698 ("iio: accel: bma400: Add triggered buffer support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
See reply to bma220 similar patch.

Not the way to fix this.  A comprehensive fix is needed and that
requires some fiddly changes in the IIO core.

Also, this doesn't even fix it...

> ---
>  drivers/iio/accel/bma400_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
> index 05f72707f830..a5889b67585e 100644
> --- a/drivers/iio/accel/bma400_core.c
> +++ b/drivers/iio/accel/bma400_core.c
> @@ -1783,7 +1783,6 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
>  			return dev_err_probe(data->dev, ret,
>  					     "iio trigger register fail\n");
>  
> -		indio_dev->trig = iio_trigger_get(data->trig);
>  		ret = devm_request_threaded_irq(dev, irq, NULL,
>  						&bma400_interrupt,
>  						IRQF_TRIGGER_RISING | IRQF_ONESHOT,
> @@ -1799,6 +1798,9 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
>  		return dev_err_probe(data->dev, ret,
>  				     "iio triggered buffer setup failed\n");
>  
> +	if (irq > 0)
> +		indio_dev->trig = iio_trigger_get(data->trig);
> +
>  	return devm_iio_device_register(dev, indio_dev);

What happens if this last call fails?  Still leaks the reference.

>  }
>  EXPORT_SYMBOL_NS(bma400_probe, "IIO_BMA400");

Re: [PATCH] iio: accel: bma400: Fix trigger reference leak in bma400_probe()

Posted by Jonathan Cameron 1 week, 1 day ago

On Thu, 17 Sep 2026 01:17:24 +0100
Jonathan Cameron <jic23@kernel.org> wrote:

> On Wed, 16 Sep 2026 16:08:25 +0000
> Wentao Liang <vulab@iscas.ac.cn> wrote:
> 
> > Move indio_dev->trig = iio_trigger_get(data->trig) after the
> > devm_request_threaded_irq() and triggered buffer setup succeed. If
> > either fails before INDIO_BUFFER_TRIGGERED is set, the IIO core does
> > not put the trigger reference in iio_dev_release(), leaking it.
> > 
> > Fixes: ffe0ab6a9698 ("iio: accel: bma400: Add triggered buffer support")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>  
> See reply to bma220 similar patch.
> 
> Not the way to fix this.  A comprehensive fix is needed and that
> requires some fiddly changes in the IIO core.
> 
> Also, this doesn't even fix it...

Looking again, maybe it does but still not how we want to fix this long term.

> 
> > ---
> >  drivers/iio/accel/bma400_core.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
> > index 05f72707f830..a5889b67585e 100644
> > --- a/drivers/iio/accel/bma400_core.c
> > +++ b/drivers/iio/accel/bma400_core.c
> > @@ -1783,7 +1783,6 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
> >  			return dev_err_probe(data->dev, ret,
> >  					     "iio trigger register fail\n");
> >  
> > -		indio_dev->trig = iio_trigger_get(data->trig);
> >  		ret = devm_request_threaded_irq(dev, irq, NULL,
> >  						&bma400_interrupt,
> >  						IRQF_TRIGGER_RISING | IRQF_ONESHOT,
> > @@ -1799,6 +1798,9 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
> >  		return dev_err_probe(data->dev, ret,
> >  				     "iio triggered buffer setup failed\n");
> >  
> > +	if (irq > 0)
> > +		indio_dev->trig = iio_trigger_get(data->trig);
> > +
> >  	return devm_iio_device_register(dev, indio_dev);  
> 
> What happens if this last call fails?  Still leaks the reference.
> 
> >  }
> >  EXPORT_SYMBOL_NS(bma400_probe, "IIO_BMA400");  
> 
>