[PATCH] iio: trigger: Return an error when the trigger has no free irq

[Karl Mehltretter <kmehltretter@gmail.com>]

iio_trigger_attach_poll_func() prints an error when all
CONFIG_IIO_CONSUMERS_PER_TRIGGER irqs of the trigger are in use, but
returns 0. The buffer of the extra consumer is enabled without a poll
function.

Disabling that buffer calls clear_bit() with a negative bit number and
drops a module reference for the second time. On arm and arm64 the
clear_bit() goes about 512 MB past the pool bitmap. That is an oops if
the address is not mapped, and a bit cleared in unrelated memory if it
is.

Return the error from iio_trigger_get_irq().

Fixes: 995438233579 ("iio: Fix error handling in iio_trigger_attach_poll_func")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Found with an experimental clang warning for a function that returns 0
right after it reports a failure.

Tested in QEMU with three consumers on one hrtimer trigger and
CONFIG_IIO_CONSUMERS_PER_TRIGGER=2. Without the patch the third write to
buffer/enable returns 0. With it the write fails with -ENOMEM and the
buffers are disabled without a message.

Disabling the buffers without the patch:

arm, vexpress-a9, st_magn on three emulated LSM303DLHC:

  Unable to handle kernel paging request at virtual address a1a2e690 when read
  PC is at _clear_bit+0x20/0x38
  LR is at iio_trigger_detach_poll_func+0x88/0xdc

arm64, virt with 256 MB, iio dummy devices:

  Unable to handle kernel paging request at virtual address ffff000020b94348
  pc : iio_trigger_put_irq+0x4c/0x74
  iio_trigger_detach_poll_func+0x4c/0x90

arm64 with 2 GB and x86_64 show no message. On x86_64 the reference
count of the dummy driver module drops by one per round.

 drivers/iio/industrialio-trigger.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 17781c12bc85..09d3dfc9d812 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -293,6 +293,7 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig,
 	if (pf->irq < 0) {
 		pr_err("Could not find an available irq for trigger %s, CONFIG_IIO_CONSUMERS_PER_TRIGGER=%d limit might be exceeded\n",
 			trig->name, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
+		ret = pf->irq;
 		goto out_put_module;
 	}
 

base-commit: e767a4ea70a3992c37ed604157d32f0dfbf9b1e3
-- 
2.53.0