The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
devm_request_threaded_irq() in scd30_setup_trigger(), or of triggered
buffer setup in scd30_probe(), returns before that mode is set and
leaks the reference acquired for indio_dev->trig. Take the reference
after the IRQ request succeeds and set up the trigger after the
buffer so that only failures with the mode already set follow the
iio_trigger_get().

Fixes: 64b3d8b1b0f5 ("iio: chemical: scd30: add core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/chemical/scd30_core.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/chemical/scd30_core.c b/drivers/iio/chemical/scd30_core.c
index a665fcb78806..dc56291e1892 100644
--- a/drivers/iio/chemical/scd30_core.c
+++ b/drivers/iio/chemical/scd30_core.c
@@ -644,8 +644,6 @@ static int scd30_setup_trigger(struct iio_dev *indio_dev)
 	if (ret)
 		return ret;
 
-	indio_dev->trig = iio_trigger_get(trig);
-
 	/*
 	 * Interrupt is enabled just before taking a fresh measurement
 	 * and disabled afterwards. This means we need to ensure it is not
@@ -659,6 +657,8 @@ static int scd30_setup_trigger(struct iio_dev *indio_dev)
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to request irq\n");
 
+	indio_dev->trig = iio_trigger_get(trig);
+
 	return 0;
 }
 
@@ -710,16 +710,16 @@ int scd30_probe(struct device *dev, int irq, const char *name, void *priv,
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to reset device\n");
 
+	ret = devm_iio_triggered_buffer_setup(dev, indio_dev, NULL, scd30_trigger_handler, NULL);
+	if (ret)
+		return ret;
+
 	if (state->irq > 0) {
 		ret = scd30_setup_trigger(indio_dev);
 		if (ret)
 			return dev_err_probe(dev, ret, "failed to setup trigger\n");
 	}
 
-	ret = devm_iio_triggered_buffer_setup(dev, indio_dev, NULL, scd30_trigger_handler, NULL);
-	if (ret)
-		return ret;
-
 	ret = scd30_command_read(state, CMD_FW_VERSION, &val);
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to read firmware version\n");
-- 
2.34.1

On Wed, 16 Sep 2026 16:28:17 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
> devm_request_threaded_irq() in scd30_setup_trigger(), or of triggered
> buffer setup in scd30_probe(), returns before that mode is set and
> leaks the reference acquired for indio_dev->trig. Take the reference
> after the IRQ request succeeds and set up the trigger after the
> buffer so that only failures with the mode already set follow the
> iio_trigger_get().
> 
> Fixes: 64b3d8b1b0f5 ("iio: chemical: scd30: add core driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Same again. See bma220. Not this solution.

Jonathan