Re: [PATCH] iio: trigger: free the trigger ID after device_del()

[Changyul Lee]

On Sat, 7 Nov 2026 01:31:59 +0000
Jonathan Cameron <jic23@xxxxxxxxxx> wrote:

> > -   ida_free(&iio_trigger_ida, trig_info->id);
> > -   /* Possible issue in here */
> This made me wonder - what is that on about?  I checked
> the history and all the code on either side of that comment has
> changed since it was added.  So who knows! :)

Thanks for applying :)

The code around the comment kept changing, but the ID was always
freed before the device was removed. I guessed that was the issue it
meant, so I dropped the comment once the order was fixed.

Thanks,
Changyul

2026년 11월 6일 (금) 오후 8:32, Jonathan Cameron <jic23@xxxxxxxxxx>님이 작성:
>
> On Fri,  6 Nov 2026 12:47:37 -0500
> Changyul Lee <lcy8047@xxxxxxxxx> wrote:
>
> > iio_trigger_unregister() returns the trigger ID to iio_trigger_ida
> > before device_del() removes the "trigger<N>" device. A trigger
> > registered in between can get the same ID, and its device_add() fails:
> >
> >   sysfs: cannot create duplicate filename '/bus/iio/devices/trigger0'
> >
> > For example, adding a sysfs trigger while an hrtimer trigger is being
> > removed through configfs, or the other way around, hits this because the
> > two paths do not share a lock.
> >
> > Free the ID after device_del(), as the error path of
> > iio_trigger_register() already does, and drop the "Possible issue in
> > here" comment.
> >
> > Fixes: 1637db44413e ("Staging: IIO: Trigger support added to core.")
> > Signed-off-by: Changyul Lee <lcy8047@xxxxxxxxx>
> Nice find. Applied to the fixes-togreg branch of iio.git.
>
> One passing comment below given you also deleted a very 'odd'
> comment!
>
>
> > ---
> > Found with a static analysis tool we are developing.
> >
> > Reproduced in QEMU (x86_64) with two threads running for 20 seconds.
> > One writes to add_trigger and remove_trigger of iio_sysfs_trigger, the
> > other creates and removes an hrtimer trigger in configfs. Without this
> > patch, device_add() failed with the error above 160 to 1148 times per
> > run in three runs. With it, it never failed.
> >
> >  drivers/iio/industrialio-trigger.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
> > index 76926fee0f84..206ede2c9b3c 100644
> > --- a/drivers/iio/industrialio-trigger.c
> > +++ b/drivers/iio/industrialio-trigger.c
> > @@ -105,9 +105,8 @@ void iio_trigger_unregister(struct iio_trigger *trig_info)
> >       scoped_guard(mutex, &iio_trigger_list_lock)
> >               list_del(&trig_info->list);
> >
> > -     ida_free(&iio_trigger_ida, trig_info->id);
> > -     /* Possible issue in here */
> This made me wonder - what is that on about?  I checked
> the history and all the code on either side of that comment has
> changed since it was added.  So who knows! :)
>
>
> >       device_del(&trig_info->dev);
> > +     ida_free(&iio_trigger_ida, trig_info->id);
> >  }
> >  EXPORT_SYMBOL(iio_trigger_unregister);
> >
> >
> > base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
>