[PATCH v3 2/2] iio: gyro: mpu3050: add missing trigger cleanup on remove()

[Joshua Crofts]

The mpu3050_trigger_probe() registers a trigger but
mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
to clean it up, causing a use-after-free bug.

Add the missing calls to the iio_trigger_unregister() function.

Reported-by: Dingisoul <dingiso.kernel@xxxxxxxxx>
Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@xxxxxxxxx/
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
---
 drivers/iio/gyro/mpu3050-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index 879caf3b729c..9e747836df3e 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1262,7 +1262,9 @@ int mpu3050_common_probe(struct device *dev,
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);
-	if (irq)
+	if (mpu3050->trig)
+		iio_trigger_unregister(mpu3050->trig);
+	if (mpu3050->irq)
 		free_irq(mpu3050->irq, mpu3050->trig);
 err_cleanup_buffer:
 	iio_triggered_buffer_cleanup(indio_dev);
@@ -1281,6 +1283,8 @@ void mpu3050_common_remove(struct device *dev)
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);
+	if (mpu3050->trig)
+		iio_trigger_unregister(mpu3050->trig);
 	if (mpu3050->irq)
 		free_irq(mpu3050->irq, mpu3050->trig);
 	iio_triggered_buffer_cleanup(indio_dev);

-- 
2.56.0