Re: [PATCH 02/15] iio: trigger: fail the attach if no sub-IRQ is left

[Nuno Sá]

On Tue, Oct 27, 2026 at 05:19:06PM +0100, Greg Kroah-Hartman wrote:
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> A trigger can serve CONFIG_IIO_CONSUMERS_PER_TRIGGER devices, two by
> default.  When one more device is attached, iio_trigger_get_irq() returns
> -ENOMEM.  iio_trigger_attach_poll_func() prints an error, drops the module
> reference and jumps to its exit, but ret is still 0 there, so it reports
> success.
> 
> iio_enable_buffers() goes on as if the poll function were attached.  The
> write to buffer/enable succeeds, but no sample ever arrives.  When the
> buffer is disabled again, iio_trigger_detach_poll_func() undoes an attach
> which has not taken place, with -ENOMEM in pf->irq:
> 
>  - iio_trigger_put_irq() calls clear_bit() with the bit number
>    -ENOMEM - trig->subirq_base, which clears a bit in whatever lies in
>    front of trig->pool;
>  - if only one of the real consumers is left, the trigger is switched off
>    under it;
>  - module_put() drops a reference to the driver module which has been
>    dropped already.
> 
> All it takes is to set the same trigger as current_trigger of three
> devices and to enable their buffers.
> 
> Return the error.
> 
> Fixes: 995438233579 ("iio: Fix error handling in iio_trigger_attach_poll_func")
> Cc: stable <stable@xxxxxxxxxx>
> Cc: David Lechner <dlechner@xxxxxxxxxxxx>
> Cc: "Nuno Sá" <nuno.sa@xxxxxxxxxx>
> Cc: Andy Shevchenko <andy@xxxxxxxxxx>
> Cc: Leonard Crestez <cdleonard@xxxxxxxxx>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Nuno Sá <nuno.sa@xxxxxxxxxx>

>  drivers/iio/industrialio-trigger.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> index 76926fee0f84..fc4651490d42 100644
> --- a/drivers/iio/industrialio-trigger.c
> +++ b/drivers/iio/industrialio-trigger.c
> @@ -293,6 +293,7 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig,
>  	if (pf->irq < 0) {
>  		pr_err("Could not find an available irq for trigger %s, CONFIG_IIO_CONSUMERS_PER_TRIGGER=%d limit might be exceeded\n",
>  			trig->name, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
> +		ret = pf->irq;
>  		goto out_put_module;
>  	}
>  
> 
> -- 
> 2.56.0
>