[PATCH] iio: adc: ad7768-1: Fix trigger reference leak in ad7768_triggered_buffer_alloc()

[PATCH] iio: adc: ad7768-1: Fix trigger reference leak in ad7768_triggered_buffer_alloc()

[Wentao Liang]

The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
devm_iio_triggered_buffer_setup() fails before setting that mode, the
reference acquired for indio_dev->trig leaks. Move the
iio_trigger_get() after the buffer setup succeeds.

Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/adc/ad7768-1.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index 73fb734d06b2..94e746c78cd8 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -1505,12 +1505,16 @@ static int ad7768_triggered_buffer_alloc(struct iio_dev *indio_dev)
 	if (ret)
 		return ret;
 
+	ret = devm_iio_triggered_buffer_setup(indio_dev->dev.parent, indio_dev,
+					      &iio_pollfunc_store_time,
+					      &ad7768_trigger_handler,
+					      &ad7768_buffer_ops);
+	if (ret)
+		return ret;
+
 	indio_dev->trig = iio_trigger_get(st->trig);
 
-	return devm_iio_triggered_buffer_setup(indio_dev->dev.parent, indio_dev,
-					       &iio_pollfunc_store_time,
-					       &ad7768_trigger_handler,
-					       &ad7768_buffer_ops);
+	return 0;
 }
 
 static int ad7768_vcm_enable(struct regulator_dev *rdev)
-- 
2.34.1

Re: [PATCH] iio: adc: ad7768-1: Fix trigger reference leak in ad7768_triggered_buffer_alloc()

[Jonathan Cameron]

On Wed, 16 Sep 2026 16:17:26 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
> devm_iio_triggered_buffer_setup() fails before setting that mode, the
> reference acquired for indio_dev->trig leaks. Move the
> iio_trigger_get() after the buffer setup succeeds.
> 
> Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Not this solution. Same reasoning...

> ---
>  drivers/iio/adc/ad7768-1.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
> index 73fb734d06b2..94e746c78cd8 100644
> --- a/drivers/iio/adc/ad7768-1.c
> +++ b/drivers/iio/adc/ad7768-1.c
> @@ -1505,12 +1505,16 @@ static int ad7768_triggered_buffer_alloc(struct iio_dev *indio_dev)
>  	if (ret)
>  		return ret;
>  
> +	ret = devm_iio_triggered_buffer_setup(indio_dev->dev.parent, indio_dev,
> +					      &iio_pollfunc_store_time,
> +					      &ad7768_trigger_handler,
> +					      &ad7768_buffer_ops);
> +	if (ret)
> +		return ret;
> +
>  	indio_dev->trig = iio_trigger_get(st->trig);
>  
> -	return devm_iio_triggered_buffer_setup(indio_dev->dev.parent, indio_dev,
> -					       &iio_pollfunc_store_time,
> -					       &ad7768_trigger_handler,
> -					       &ad7768_buffer_ops);
> +	return 0;
>  }
>  
>  static int ad7768_vcm_enable(struct regulator_dev *rdev)

Re: [PATCH] iio: adc: ad7768-1: Fix trigger reference leak in ad7768_triggered_buffer_alloc()

[Wentao Liang]

Hi Jonathan,

Sorry for the very late reply.

I understand your feedback: this fix should not depend on a subtle
ordering constraint in the driver. Trigger lifetime handling needs a
broader solution in the IIO core, as you explained in the bma220 thread.

Please disregard this patch; I will not resend this approach as v2.
Thank you for the review.

For transparency, we use static analysis tools to identify candidates,
then DeepSeek and GPT-6.1 Sol to assist with auditing and preparing fixes.
I am responsible for verifying the findings and changes before submission.

Best regards,
Wentao