viio_trigger_alloc() initializes the device with device_initialize() but uses kfree() directly in error paths, which bypasses the device's release callback iio_trig_release(). This could lead to memory leaks and inconsistent device state.
Replace kfree(trig) with put_device(&trig->dev) in error paths to ensure proper cleanup through the device's release callback.
Found by code review.
Cc: stable@vger.kernel.org Fixes: 2c99f1a09da3 ("iio: trigger: clean up viio_trigger_alloc()") Signed-off-by: Ma Ke make24@iscas.ac.cn --- drivers/iio/industrialio-trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c index 54416a384232..981e19757870 100644 --- a/drivers/iio/industrialio-trigger.c +++ b/drivers/iio/industrialio-trigger.c @@ -597,7 +597,7 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent, free_descs: irq_free_descs(trig->subirq_base, CONFIG_IIO_CONSUMERS_PER_TRIGGER); free_trig: - kfree(trig); + put_device(&trig->dev); return NULL; }
On Wed, Nov 05, 2025 at 05:47:14PM +0800, Ma Ke wrote:
viio_trigger_alloc() initializes the device with device_initialize() but uses kfree() directly in error paths, which bypasses the device's release callback iio_trig_release(). This could lead to memory leaks and inconsistent device state.
Replace kfree(trig) with put_device(&trig->dev) in error paths to ensure proper cleanup through the device's release callback.
Now when irq_alloc_descs() fails, trig->subirq_base becomes negative and in the release callback it will pass the
if (trig->subirq_base) {
Is it a problem?
The release function also misses mutex_destroy().
On Wed, Nov 05, 2025 at 05:04:32PM +0200, Andy Shevchenko wrote:
On Wed, Nov 05, 2025 at 05:47:14PM +0800, Ma Ke wrote:
viio_trigger_alloc() initializes the device with device_initialize() but uses kfree() directly in error paths, which bypasses the device's release callback iio_trig_release(). This could lead to memory leaks and inconsistent device state.
Replace kfree(trig) with put_device(&trig->dev) in error paths to ensure proper cleanup through the device's release callback.
Now when irq_alloc_descs() fails, trig->subirq_base becomes negative and in the release callback it will pass the
if (trig->subirq_base) {Is it a problem?
The release function also misses mutex_destroy().
Ah, and if kvasprintf() fails, the error path will call irq_free_descs() and then one more time in the release callback.
You finding is good, but the fix needs to be crafted thoughtfully.
linux-stable-mirror@lists.linaro.org
-
Andy Shevchenko -
Ma Ke