The reference acquired for indio_dev->trig is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Move the
iio_trigger_get() after iio_triggered_buffer_setup() succeeds so that
failure of motion trigger registration or buffer setup, which return
before the mode is set, no longer leak the trigger reference.

Fixes: c1288b833881 ("iio: accel: kxcjk-1013: Increment ref counter for indio_dev->trig")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/accel/kxcjk-1013.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 2823ddde4bf2..dbaa829a98c2 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1488,10 +1488,6 @@ static int kxcjk1013_probe(struct i2c_client *client)
 		if (ret)
 			goto err_poweroff;
 
-		indio_dev->trig = iio_trigger_get(data->dready_trig);
-
-		data->motion_trig->ops = &kxcjk1013_trigger_ops;
-		iio_trigger_set_drvdata(data->motion_trig, indio_dev);
 		ret = iio_trigger_register(data->motion_trig);
 		if (ret) {
 			data->motion_trig = NULL;
@@ -1508,6 +1504,9 @@ static int kxcjk1013_probe(struct i2c_client *client)
 		goto err_trigger_unregister;
 	}
 
+	if (data->dready_trig)
+		indio_dev->trig = iio_trigger_get(data->dready_trig);
+
 	ret = pm_runtime_set_active(&client->dev);
 	if (ret)
 		goto err_buffer_cleanup;
-- 
2.34.1

On Wed, 16 Sep 2026 16:10:54 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference acquired for indio_dev->trig is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Move the
> iio_trigger_get() after iio_triggered_buffer_setup() succeeds so that
> failure of motion trigger registration or buffer setup, which return
> before the mode is set, no longer leak the trigger reference.
> 
> Fixes: c1288b833881 ("iio: accel: kxcjk-1013: Increment ref counter for indio_dev->trig")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

See bma220 reply. Not something we are going to fix like this.

> ---
>  drivers/iio/accel/kxcjk-1013.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
> index 2823ddde4bf2..dbaa829a98c2 100644
> --- a/drivers/iio/accel/kxcjk-1013.c
> +++ b/drivers/iio/accel/kxcjk-1013.c
> @@ -1488,10 +1488,6 @@ static int kxcjk1013_probe(struct i2c_client *client)
>  		if (ret)
>  			goto err_poweroff;
>  
> -		indio_dev->trig = iio_trigger_get(data->dready_trig);
> -
> -		data->motion_trig->ops = &kxcjk1013_trigger_ops;
> -		iio_trigger_set_drvdata(data->motion_trig, indio_dev);
>  		ret = iio_trigger_register(data->motion_trig);
>  		if (ret) {
>  			data->motion_trig = NULL;
> @@ -1508,6 +1504,9 @@ static int kxcjk1013_probe(struct i2c_client *client)
>  		goto err_trigger_unregister;
>  	}
>  
> +	if (data->dready_trig)
> +		indio_dev->trig = iio_trigger_get(data->dready_trig);
> +
>  	ret = pm_runtime_set_active(&client->dev);
>  	if (ret)
>  		goto err_buffer_cleanup;