Re: [PATCH] iio: accel: bma400: Fix trigger reference leak in bma400_probe()

[Jonathan Cameron]

On Wed, 16 Sep 2026 16:08:25 +0000
Wentao Liang <vulab@xxxxxxxxxxx> wrote:

> Move indio_dev->trig = iio_trigger_get(data->trig) after the
> devm_request_threaded_irq() and triggered buffer setup succeed. If
> either fails before INDIO_BUFFER_TRIGGERED is set, the IIO core does
> not put the trigger reference in iio_dev_release(), leaking it.
> 
> Fixes: ffe0ab6a9698 ("iio: accel: bma400: Add triggered buffer support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
See reply to bma220 similar patch.

Not the way to fix this.  A comprehensive fix is needed and that
requires some fiddly changes in the IIO core.

Also, this doesn't even fix it...

> ---
>  drivers/iio/accel/bma400_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
> index 05f72707f830..a5889b67585e 100644
> --- a/drivers/iio/accel/bma400_core.c
> +++ b/drivers/iio/accel/bma400_core.c
> @@ -1783,7 +1783,6 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
>  			return dev_err_probe(data->dev, ret,
>  					     "iio trigger register fail\n");
>  
> -		indio_dev->trig = iio_trigger_get(data->trig);
>  		ret = devm_request_threaded_irq(dev, irq, NULL,
>  						&bma400_interrupt,
>  						IRQF_TRIGGER_RISING | IRQF_ONESHOT,
> @@ -1799,6 +1798,9 @@ int bma400_probe(struct device *dev, struct regmap *regmap, int irq,
>  		return dev_err_probe(data->dev, ret,
>  				     "iio triggered buffer setup failed\n");
>  
> +	if (irq > 0)
> +		indio_dev->trig = iio_trigger_get(data->trig);
> +
>  	return devm_iio_device_register(dev, indio_dev);

What happens if this last call fails?  Still leaks the reference.

>  }
>  EXPORT_SYMBOL_NS(bma400_probe, "IIO_BMA400");