[PATCH] iio: trigger: Return an error when the trigger has no free irq

[PATCH] iio: trigger: Return an error when the trigger has no free irq

[Karl Mehltretter]

iio_trigger_attach_poll_func() prints an error when all
CONFIG_IIO_CONSUMERS_PER_TRIGGER irqs of the trigger are in use, but
returns 0. The buffer of the extra consumer is enabled without a poll
function.

Disabling that buffer calls clear_bit() with a negative bit number and
drops a module reference for the second time. On arm and arm64 the
clear_bit() goes about 512 MB past the pool bitmap. That is an oops if
the address is not mapped, and a bit cleared in unrelated memory if it
is.

Return the error from iio_trigger_get_irq().

Fixes: 995438233579 ("iio: Fix error handling in iio_trigger_attach_poll_func")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Found with an experimental clang warning for a function that returns 0
right after it reports a failure.

Tested in QEMU with three consumers on one hrtimer trigger and
CONFIG_IIO_CONSUMERS_PER_TRIGGER=2. Without the patch the third write to
buffer/enable returns 0. With it the write fails with -ENOMEM and the
buffers are disabled without a message.

Disabling the buffers without the patch:

arm, vexpress-a9, st_magn on three emulated LSM303DLHC:

  Unable to handle kernel paging request at virtual address a1a2e690 when read
  PC is at _clear_bit+0x20/0x38
  LR is at iio_trigger_detach_poll_func+0x88/0xdc

arm64, virt with 256 MB, iio dummy devices:

  Unable to handle kernel paging request at virtual address ffff000020b94348
  pc : iio_trigger_put_irq+0x4c/0x74
  iio_trigger_detach_poll_func+0x4c/0x90

arm64 with 2 GB and x86_64 show no message. On x86_64 the reference
count of the dummy driver module drops by one per round.

 drivers/iio/industrialio-trigger.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 17781c12bc85..09d3dfc9d812 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -293,6 +293,7 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig,
 	if (pf->irq < 0) {
 		pr_err("Could not find an available irq for trigger %s, CONFIG_IIO_CONSUMERS_PER_TRIGGER=%d limit might be exceeded\n",
 			trig->name, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
+		ret = pf->irq;
 		goto out_put_module;
 	}
 

base-commit: e767a4ea70a3992c37ed604157d32f0dfbf9b1e3
-- 
2.53.0

Re: [PATCH] iio: trigger: Return an error when the trigger has no free irq

[Joshua Crofts]

On Tue,  6 Oct 2026 05:41:47 +0200
Karl Mehltretter <kmehltretter@gmail.com> wrote:

> iio_trigger_attach_poll_func() prints an error when all
> CONFIG_IIO_CONSUMERS_PER_TRIGGER irqs of the trigger are in use, but
> returns 0. The buffer of the extra consumer is enabled without a poll
> function.
> 
> Disabling that buffer calls clear_bit() with a negative bit number and
> drops a module reference for the second time. On arm and arm64 the
> clear_bit() goes about 512 MB past the pool bitmap. That is an oops if
> the address is not mapped, and a bit cleared in unrelated memory if it
> is.
> 
> Return the error from iio_trigger_get_irq().
> 
> Fixes: 995438233579 ("iio: Fix error handling in iio_trigger_attach_poll_func")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---

A 10 year old bug. Nice find!

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts