Re: [PATCH v2] iio: gyro: mpu3050: add missing trigger cleanup on remove

[Joshua Crofts]

On Thu, 15 Oct 2026 21:58:35 +0200
Joshua Crofts <joshua.crofts1@xxxxxxxxx> wrote:

> The mpu3050_trigger_probe() function registers a trigger but
> mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> to clean it up, causing a use-after-free bug.
> 
> Add the missing iio_trigger_unregister() function. Additionally, change
> the mpu3050_trigger_probe() function to assign trig only after it is
> registered successfully to prevent a null pointer dereference using a
> local struct iio_trigger.
> 
> Reported-by: Dingisoul <dingiso.kernel@xxxxxxxxx>
> Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@xxxxxxxxx/
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>
> ---

Dingisoul, any chance you can test this?

Q to others: better to leave the driver running in this weird
polling mode as it is now or return on trigger register failure
as Nuno suggests?

Thanks.

-- 
Kind regards,
Joshua Crofts