[PATCH] iio: imu: smi330: Fix trigger reference leak in smi330_core_probe()

[PATCH] iio: imu: smi330: Fix trigger reference leak in smi330_core_probe()

[Wentao Liang]

The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
devm_iio_triggered_buffer_setup() fails before setting that mode, the
reference acquired for indio_dev->trig leaks. Move the
iio_trigger_get() after the buffer setup succeeds.

Fixes: 6f3d8de8886d ("iio: imu: smi330: Add driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/iio/imu/smi330/smi330_core.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/imu/smi330/smi330_core.c b/drivers/iio/imu/smi330/smi330_core.c
index 7ec5ae7f521a..6bd735c6b61a 100644
--- a/drivers/iio/imu/smi330/smi330_core.c
+++ b/drivers/iio/imu/smi330/smi330_core.c
@@ -886,9 +886,6 @@ int smi330_core_probe(struct device *dev, struct regmap *regmap)
 		if (ret)
 			return dev_err_probe(dev, ret,
 					     "IIO register trigger failed\n");
-
-		/* Set default operation mode to data ready. */
-		indio_dev->trig = iio_trigger_get(data->trig);
 	}
 
 	ret = devm_iio_triggered_buffer_setup(dev, indio_dev,
@@ -897,6 +894,11 @@ int smi330_core_probe(struct device *dev, struct regmap *regmap)
 	if (ret)
 		return dev_err_probe(dev, ret, "IIO buffer setup failed\n");
 
+	if (data->trig) {
+		/* Set default operation mode to data ready. */
+		indio_dev->trig = iio_trigger_get(data->trig);
+	}
+
 	ret = devm_iio_device_register(dev, indio_dev);
 	if (ret)
 		return dev_err_probe(dev, ret, "Register IIO device failed\n");
-- 
2.34.1

Re: [PATCH] iio: imu: smi330: Fix trigger reference leak in smi330_core_probe()

[Jonathan Cameron]

On Wed, 16 Sep 2026 16:32:50 +0000
Wentao Liang <vulab@iscas.ac.cn> wrote:

> The reference taken with iio_trigger_get() is only dropped by
> iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. If
> devm_iio_triggered_buffer_setup() fails before setting that mode, the
> reference acquired for indio_dev->trig leaks. Move the
> iio_trigger_get() after the buffer setup succeeds.
> 
> Fixes: 6f3d8de8886d ("iio: imu: smi330: Add driver")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Same again.  Not going to introduce subtle ordering fixes like this.
We need a comprehensive solution with appropriate changes in the
IIO core to handle cleaning that reference up. See bma220 for
more on this.

> ---
>  drivers/iio/imu/smi330/smi330_core.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/imu/smi330/smi330_core.c b/drivers/iio/imu/smi330/smi330_core.c
> index 7ec5ae7f521a..6bd735c6b61a 100644
> --- a/drivers/iio/imu/smi330/smi330_core.c
> +++ b/drivers/iio/imu/smi330/smi330_core.c
> @@ -886,9 +886,6 @@ int smi330_core_probe(struct device *dev, struct regmap *regmap)
>  		if (ret)
>  			return dev_err_probe(dev, ret,
>  					     "IIO register trigger failed\n");
> -
> -		/* Set default operation mode to data ready. */
> -		indio_dev->trig = iio_trigger_get(data->trig);
>  	}
>  
>  	ret = devm_iio_triggered_buffer_setup(dev, indio_dev,
> @@ -897,6 +894,11 @@ int smi330_core_probe(struct device *dev, struct regmap *regmap)
>  	if (ret)
>  		return dev_err_probe(dev, ret, "IIO buffer setup failed\n");
>  
> +	if (data->trig) {
> +		/* Set default operation mode to data ready. */
> +		indio_dev->trig = iio_trigger_get(data->trig);
> +	}
> +
>  	ret = devm_iio_device_register(dev, indio_dev);
>  	if (ret)
>  		return dev_err_probe(dev, ret, "Register IIO device failed\n");