[PATCH] iio: accel: bma220: Fix trigger reference leak in bma220_common_probe()

[Wentao Liang]

indio_dev->trig holds an extra reference taken by iio_trigger_get(). It is
only dropped by iio_dev_release() when the device has a triggered mode set,
and indio_dev->modes is still INDIO_DIRECT_MODE until
devm_iio_triggered_buffer_setup() runs. Both early error paths return
before that point, so the reference is leaked.

Release the trigger reference on the IRQ request and the deinit action
failure paths.

Fixes: b7e17ca10793 ("iio: accel: bma220: add interrupt trigger")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/iio/accel/bma220_core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/accel/bma220_core.c b/drivers/iio/accel/bma220_core.c
index f32d875b994e..4820d99e214a 100644
--- a/drivers/iio/accel/bma220_core.c
+++ b/drivers/iio/accel/bma220_core.c
@@ -544,14 +544,19 @@ int bma220_common_probe(struct device *dev, struct regmap *regmap, int irq)
 		ret = devm_request_threaded_irq(dev, irq, NULL,
 						&bma220_irq_handler, IRQF_ONESHOT,
 						indio_dev->name, indio_dev);
-		if (ret)
+		if (ret) {
+			iio_trigger_put(indio_dev->trig);
 			return dev_err_probe(dev, ret,
 					     "request irq %d failed\n", irq);
+		}
 	}
 
 	ret = devm_add_action_or_reset(dev, bma220_deinit, data);
-	if (ret)
+	if (ret) {
+		if (indio_dev->trig)
+			iio_trigger_put(indio_dev->trig);
 		return ret;
+	}
 
 	ret = devm_iio_triggered_buffer_setup(dev, indio_dev, NULL,
 					      bma220_trigger_handler, NULL);
-- 
2.34.1