iio: temperature: tmp006: Fix trigger reference leak in tmp006_probe()

[PATCH] iio: temperature: tmp006: Fix trigger reference leak in tmp006_probe()

Posted by Wentao Liang 1 week, 1 day ago

The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
devm_request_irq() or of triggered buffer setup returns before that
mode is set and leaks the reference acquired for indio_dev->trig.
Take the reference only after the triggered buffer setup succeeds.

Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/temperature/tmp006.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index d8d8c8936d17..06303ce72bfb 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -354,8 +354,6 @@ static int tmp006_probe(struct i2c_client *client)
 		if (ret)
 			return ret;
 
-		indio_dev->trig = iio_trigger_get(data->drdy_trig);
-
 		ret = devm_request_irq(&client->dev, client->irq,
 				       iio_trigger_generic_data_rdy_poll,
 				       IRQF_NO_THREAD, "tmp006_irq",
@@ -369,6 +367,9 @@ static int tmp006_probe(struct i2c_client *client)
 	if (ret < 0)
 		return ret;
 
+	if (data->drdy_trig)
+		indio_dev->trig = iio_trigger_get(data->drdy_trig);
+
 	return devm_iio_device_register(&client->dev, indio_dev);
 }
 
-- 
2.34.1

Re: [PATCH] iio: temperature: tmp006: Fix trigger reference leak in tmp006_probe()

Posted by Jonathan Cameron 1 week, 1 day ago

On Wed, 16 Sep 2026 16:45:17 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
> devm_request_irq() or of triggered buffer setup returns before that
> mode is set and leaks the reference acquired for indio_dev->trig.
> Take the reference only after the triggered buffer setup succeeds.
> 
> Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Not this way - see other threads on same topic.

> ---
>  drivers/iio/temperature/tmp006.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
> index d8d8c8936d17..06303ce72bfb 100644
> --- a/drivers/iio/temperature/tmp006.c
> +++ b/drivers/iio/temperature/tmp006.c
> @@ -354,8 +354,6 @@ static int tmp006_probe(struct i2c_client *client)
>  		if (ret)
>  			return ret;
>  
> -		indio_dev->trig = iio_trigger_get(data->drdy_trig);
> -
>  		ret = devm_request_irq(&client->dev, client->irq,
>  				       iio_trigger_generic_data_rdy_poll,
>  				       IRQF_NO_THREAD, "tmp006_irq",
> @@ -369,6 +367,9 @@ static int tmp006_probe(struct i2c_client *client)
>  	if (ret < 0)
>  		return ret;
>  
> +	if (data->drdy_trig)
> +		indio_dev->trig = iio_trigger_get(data->drdy_trig);
> +
>  	return devm_iio_device_register(&client->dev, indio_dev);
>  }
>