Re: [PATCH v2] iio: gyro: mpu3050: add missing trigger cleanup on remove

[Jonathan Cameron]

On Fri, 16 Oct 2026 09:39:51 +0100
Nuno Sá <nuno.sa@xxxxxxxxxx> wrote:

> On Thu, Oct 15, 2026 at 10:18:18PM +0200, Joshua Crofts wrote:
> > On Thu, 15 Oct 2026 21:58:35 +0200
> > Joshua Crofts <joshua.crofts1@xxxxxxxxx> wrote:
> >   
> > > The mpu3050_trigger_probe() function registers a trigger but
> > > mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> > > to clean it up, causing a use-after-free bug.
> > > 
> > > Add the missing iio_trigger_unregister() function. Additionally, change
> > > the mpu3050_trigger_probe() function to assign trig only after it is
> > > registered successfully to prevent a null pointer dereference using a
> > > local struct iio_trigger.
> > > 
> > > Reported-by: Dingisoul <dingiso.kernel@xxxxxxxxx>
> > > Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@xxxxxxxxx/
> > > Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> > > ---  
> > 
> > Dingisoul, any chance you can test this?
> > 
> > Q to others: better to leave the driver running in this weird
> > polling mode as it is now or return on trigger register failure
> > as Nuno suggests?  
> 
> Don't think it makes sense to continue if the idea is to have trigger
> but something failed when dealing with it. At the very least we should
> then drop the memory we allocated for it.

Fully agree. If there is an irq and trigger registration fails, fail
the probe.  Not doing that just leaves us with more corner cases
to bite us in future (such as tidying up the otherwise devm managed
trigger).  Note the mix of devm and non devm in here isn't something
we'd do today but may not be worth the effort of cleaning up.

Jonathan

> 
> - Nuno Sá
> > 
> > Thanks.
> > 
> > -- 
> > Kind regards,
> > Joshua Crofts