On Wed, Nov 05, 2025 at 05:04:32PM +0200, Andy Shevchenko wrote:
On Wed, Nov 05, 2025 at 05:47:14PM +0800, Ma Ke wrote:
viio_trigger_alloc() initializes the device with device_initialize() but uses kfree() directly in error paths, which bypasses the device's release callback iio_trig_release(). This could lead to memory leaks and inconsistent device state.
Replace kfree(trig) with put_device(&trig->dev) in error paths to ensure proper cleanup through the device's release callback.
Now when irq_alloc_descs() fails, trig->subirq_base becomes negative and in the release callback it will pass the
if (trig->subirq_base) {Is it a problem?
The release function also misses mutex_destroy().
Ah, and if kvasprintf() fails, the error path will call irq_free_descs() and then one more time in the release callback.
You finding is good, but the fix needs to be crafted thoughtfully.