iio: adc: ad7606: Fix trigger reference leak in ad7606_probe()

[PATCH] iio: adc: ad7606: Fix trigger reference leak in ad7606_probe()

Posted by Wentao Liang 1 week, 1 day ago

The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
devm_request_threaded_irq() or triggered buffer setup fails, probe
returns before the mode is set and the trigger reference leaks. Move
the iio_trigger_get() after those setup steps succeed.

Fixes: cc49bd1652a4 ("staging: iio: adc: ad7606: Add support for threaded irq")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/adc/ad7606.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
index d9271894f091..2deef474001b 100644
--- a/drivers/iio/adc/ad7606.c
+++ b/drivers/iio/adc/ad7606.c
@@ -1638,8 +1638,6 @@ int ad7606_probe(struct device *dev, int irq, void __iomem *base_address,
 		if (ret)
 			return ret;
 
-		indio_dev->trig = iio_trigger_get(st->trig);
-
 		ret = devm_request_threaded_irq(dev, irq, NULL, &ad7606_interrupt,
 						IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
 						chip_info->name, indio_dev);
@@ -1652,6 +1650,8 @@ int ad7606_probe(struct device *dev, int irq, void __iomem *base_address,
 						      &ad7606_buffer_ops);
 		if (ret)
 			return ret;
+
+		indio_dev->trig = iio_trigger_get(st->trig);
 	}
 
 	st->write_scale = ad7606_write_scale_hw;
-- 
2.34.1

Re: [PATCH] iio: adc: ad7606: Fix trigger reference leak in ad7606_probe()

Posted by Jonathan Cameron 1 week, 1 day ago

On Wed, 16 Sep 2026 16:14:54 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
> devm_request_threaded_irq() or triggered buffer setup fails, probe
> returns before the mode is set and the trigger reference leaks. Move
> the iio_trigger_get() after those setup steps succeed.
> 
> Fixes: cc49bd1652a4 ("staging: iio: adc: ad7606: Add support for threaded irq")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
As in bma220 though slightly different reasoning.

No to this as too magic to rely on ordering. Needs a better fix with
the registration state transitions handle in the iio core. There
should be no such ordering constraint.

Jonathan

> ---
>  drivers/iio/adc/ad7606.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
> index d9271894f091..2deef474001b 100644
> --- a/drivers/iio/adc/ad7606.c
> +++ b/drivers/iio/adc/ad7606.c
> @@ -1638,8 +1638,6 @@ int ad7606_probe(struct device *dev, int irq, void __iomem *base_address,
>  		if (ret)
>  			return ret;
>  
> -		indio_dev->trig = iio_trigger_get(st->trig);
> -
>  		ret = devm_request_threaded_irq(dev, irq, NULL, &ad7606_interrupt,
>  						IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
>  						chip_info->name, indio_dev);
> @@ -1652,6 +1650,8 @@ int ad7606_probe(struct device *dev, int irq, void __iomem *base_address,
>  						      &ad7606_buffer_ops);
>  		if (ret)
>  			return ret;
> +
> +		indio_dev->trig = iio_trigger_get(st->trig);
>  	}
>  
>  	st->write_scale = ad7606_write_scale_hw;