Re: [PATCH v2] iio: gyro: mpu3050: add missing trigger cleanup on remove

[Nuno Sá]

On Thu, Oct 15, 2026 at 10:18:18PM +0200, Joshua Crofts wrote:
> On Thu, 15 Oct 2026 21:58:35 +0200
> Joshua Crofts <joshua.crofts1@xxxxxxxxx> wrote:
> 
> > The mpu3050_trigger_probe() function registers a trigger but
> > mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> > to clean it up, causing a use-after-free bug.
> > 
> > Add the missing iio_trigger_unregister() function. Additionally, change
> > the mpu3050_trigger_probe() function to assign trig only after it is
> > registered successfully to prevent a null pointer dereference using a
> > local struct iio_trigger.
> > 
> > Reported-by: Dingisoul <dingiso.kernel@xxxxxxxxx>
> > Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@xxxxxxxxx/
> > Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> > ---
> 
> Dingisoul, any chance you can test this?
> 
> Q to others: better to leave the driver running in this weird
> polling mode as it is now or return on trigger register failure
> as Nuno suggests?

Don't think it makes sense to continue if the idea is to have trigger
but something failed when dealing with it. At the very least we should
then drop the memory we allocated for it.

- Nuno Sá
> 
> Thanks.
> 
> -- 
> Kind regards,
> Joshua Crofts