The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
devm_request_irq() in ens160_setup_trigger(), or of chip init or
triggered buffer setup in devm_ens160_core_probe(), returns before
that mode is set and leaks the reference acquired for indio_dev->trig.
Request the IRQ before taking the reference and set up the trigger
after the triggered buffer so that only failures with the mode
already set follow the iio_trigger_get().

Fixes: 0fc26596b4b3 ("iio: chemical: ens160: add triggered buffer support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/chemical/ens160_core.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/drivers/iio/chemical/ens160_core.c b/drivers/iio/chemical/ens160_core.c
index bbc96c4c6283..d2f56e4483ba 100644
--- a/drivers/iio/chemical/ens160_core.c
+++ b/drivers/iio/chemical/ens160_core.c
@@ -314,14 +314,13 @@ static int ens160_setup_trigger(struct iio_dev *indio_dev, int irq)
 	if (ret)
 		return ret;
 
-	indio_dev->trig = iio_trigger_get(trig);
-
 	ret = devm_request_irq(dev, irq, iio_trigger_generic_data_rdy_poll,
-			       IRQF_NO_THREAD, indio_dev->name,
-			       indio_dev->trig);
+			       IRQF_NO_THREAD, indio_dev->name, trig);
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to request irq\n");
 
+	indio_dev->trig = iio_trigger_get(trig);
+
 	return 0;
 }
 
@@ -345,13 +344,6 @@ int devm_ens160_core_probe(struct device *dev, struct regmap *regmap, int irq,
 	indio_dev->channels = ens160_channels;
 	indio_dev->num_channels = ARRAY_SIZE(ens160_channels);
 
-	if (irq > 0) {
-		ret = ens160_setup_trigger(indio_dev, irq);
-		if (ret)
-			return dev_err_probe(dev, ret,
-					     "failed to setup trigger\n");
-	}
-
 	ret = ens160_chip_init(data);
 	if (ret)
 		return dev_err_probe(dev, ret, "chip initialization failed\n");
@@ -364,6 +356,13 @@ int devm_ens160_core_probe(struct device *dev, struct regmap *regmap, int irq,
 	if (ret)
 		return ret;
 
+	if (irq > 0) {
+		ret = ens160_setup_trigger(indio_dev, irq);
+		if (ret)
+			return dev_err_probe(dev, ret,
+					     "failed to setup trigger\n");
+	}
+
 	return devm_iio_device_register(dev, indio_dev);
 }
 EXPORT_SYMBOL_NS(devm_ens160_core_probe, "IIO_ENS160");
-- 
2.34.1

On Wed, 16 Sep 2026 16:26:38 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
> devm_request_irq() in ens160_setup_trigger(), or of chip init or
> triggered buffer setup in devm_ens160_core_probe(), returns before
> that mode is set and leaks the reference acquired for indio_dev->trig.
> Request the IRQ before taking the reference and set up the trigger
> after the triggered buffer so that only failures with the mode
> already set follow the iio_trigger_get().
> 
> Fixes: 0fc26596b4b3 ("iio: chemical: ens160: add triggered buffer support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Same again. Not this solution.