Re: [PATCH] iio: accel: bma400: Fix trigger reference leak in bma400_probe()

[Jonathan Cameron <jic23@kernel.org>]

On Thu, 17 Sep 2026 01:17:24 +0100
Jonathan Cameron <jic23@kernel.org> wrote:

> On Wed, 16 Sep 2026 16:08:25 +0000
> Wentao Liang <vulab@iscas.ac.cn> wrote:
> 
> > Move indio_dev->trig = iio_trigger_get(data->trig) after the
> > devm_request_threaded_irq() and triggered buffer setup succeed. If
> > either fails before INDIO_BUFFER_TRIGGERED is set, the IIO core does
> > not put the trigger reference in iio_dev_release(), leaking it.
> > 
> > Fixes: ffe0ab6a9698 ("iio: accel: bma400: Add triggered buffer support")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>  
> See reply to bma220 similar patch.
> 
> Not the way to fix this.  A comprehensive fix is needed and that
> requires some fiddly changes in the IIO core.
> 
> Also, this doesn't even fix it...

Looking again, maybe it does but still not how we want to fix this long term.

> 
> > ---
> >  drivers/iio/accel/bma400_core.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
> > index 05f72707f830..a5889b67585e 100644
> > --- a/drivers/iio/accel/bma400_core.c
> > +++ b/drivers/iio/accel/bma400_core.c
> > @@ -1783,7 +1783,6 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
> >  			return dev_err_probe(data->dev, ret,
> >  					     "iio trigger register fail\n");
> >  
> > -		indio_dev->trig = iio_trigger_get(data->trig);
> >  		ret = devm_request_threaded_irq(dev, irq, NULL,
> >  						&bma400_interrupt,
> >  						IRQF_TRIGGER_RISING | IRQF_ONESHOT,
> > @@ -1799,6 +1798,9 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
> >  		return dev_err_probe(data->dev, ret,
> >  				     "iio triggered buffer setup failed\n");
> >  
> > +	if (irq > 0)
> > +		indio_dev->trig = iio_trigger_get(data->trig);
> > +
> >  	return devm_iio_device_register(dev, indio_dev);  
> 
> What happens if this last call fails?  Still leaks the reference.
> 
> >  }
> >  EXPORT_SYMBOL_NS(bma400_probe, "IIO_BMA400");  
> 
>