[PATCH] iio: temperature: tmp006: Fix trigger reference leak in tmp006_probe()

From: Wentao Liang

Date: Wed Sep 16 2026 - 14:28:19 EST


The reference taken with iio_trigger_get() is only dropped by
iio_dev_release() when INDIO_BUFFER_TRIGGERED is set. Failure of
devm_request_irq() or of triggered buffer setup returns before that
mode is set and leaks the reference acquired for indio_dev->trig.
Take the reference only after the triggered buffer setup succeeds.

Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/iio/temperature/tmp006.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index d8d8c8936d17..06303ce72bfb 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -354,8 +354,6 @@ static int tmp006_probe(struct i2c_client *client)
if (ret)
return ret;

- indio_dev->trig = iio_trigger_get(data->drdy_trig);
-
ret = devm_request_irq(&client->dev, client->irq,
iio_trigger_generic_data_rdy_poll,
IRQF_NO_THREAD, "tmp006_irq",
@@ -369,6 +367,9 @@ static int tmp006_probe(struct i2c_client *client)
if (ret < 0)
return ret;

+ if (data->drdy_trig)
+ indio_dev->trig = iio_trigger_get(data->drdy_trig);
+
return devm_iio_device_register(&client->dev, indio_dev);
}

--
2.34.1