[PATCH v2] iio: gyro: mpu3050: Fix runtime PM leak on trigger errors

[PATCH v2] iio: gyro: mpu3050: Fix runtime PM leak on trigger errors

[Ruoyu Wang]

The first user of the MPU-3050 data-ready trigger takes a runtime PM
reference before configuring the FIFO, sample engine and interrupt. If
any of those operations fails, iio_trigger_attach_poll_func() tears down
its IRQ resources without calling set_trigger_state(false). The buffer
error path then releases only its preenable reference, leaving the
trigger's reference held and preventing runtime suspend.

Use PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND() so a failed resume does
not leave a usage count behind and later setup failures automatically
release the acquired reference. Disarm the scoped cleanup after the
interrupt has been enabled, leaving the disable path to release the
trigger's reference. Keep hw_irq_trigger clear unless interrupt setup
succeeds.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: f11d59d87b8622 ("iio: Move attach/detach of the poll func to the core")
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
Changes in v2:
- Use the PM_RUNTIME_ACQUIRE*() cleanup API requested by Andy Shevchenko.
- Retain the runtime PM reference only after trigger setup succeeds.

Link: https://lore.kernel.org/r/20260814134111.1387580-1-ruoyuw560@gmail.com/
---
 drivers/iio/gyro/mpu3050-core.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index d84e04e4b4314..d3ae998445115 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -988,8 +988,10 @@ static int mpu3050_drdy_trigger_set_state(struct iio_trigger *trig,
 		return 0;
 	} else {
 		/* Else we're enabling the trigger from this point */
-		pm_runtime_get_sync(mpu3050->dev);
-		mpu3050->hw_irq_trigger = true;
+		PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND(mpu3050->dev, pm);
+		ret = PM_RUNTIME_ACQUIRE_ERR(&pm);
+		if (ret)
+			return ret;
 
 		/* Disable all things in the FIFO */
 		ret = regmap_write(mpu3050->map, MPU3050_FIFO_EN, 0);
@@ -1035,9 +1037,14 @@ static int mpu3050_drdy_trigger_set_state(struct iio_trigger *trig,
 		if (mpu3050->irq_opendrain)
 			val |= MPU3050_INT_OPEN;
 
+		mpu3050->hw_irq_trigger = true;
 		ret = regmap_write(mpu3050->map, MPU3050_INT_CFG, val);
-		if (ret)
+		if (ret) {
+			mpu3050->hw_irq_trigger = false;
 			return ret;
+		}
+
+		retain_and_null_ptr(pm);
 	}
 
 	return 0;
-- 
2.51.0

Re: [PATCH v2] iio: gyro: mpu3050: Fix runtime PM leak on trigger errors

[Andy Shevchenko]

On Tue, Aug 18, 2026 at 09:30:46PM +0800, Ruoyu Wang wrote:
> The first user of the MPU-3050 data-ready trigger takes a runtime PM
> reference before configuring the FIFO, sample engine and interrupt. If
> any of those operations fails, iio_trigger_attach_poll_func() tears down
> its IRQ resources without calling set_trigger_state(false). The buffer
> error path then releases only its preenable reference, leaving the
> trigger's reference held and preventing runtime suspend.
> 
> Use PM_RUNTIME_ACQUIRE_IF_ENABLED_AUTOSUSPEND() so a failed resume does
> not leave a usage count behind and later setup failures automatically
> release the acquired reference. Disarm the scoped cleanup after the
> interrupt has been enabled, leaving the disable path to release the
> trigger's reference. Keep hw_irq_trigger clear unless interrupt setup
> succeeds.
> 
> This issue was found by a static analysis checker and confirmed by manual
> source review.

...

> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>

I'm not sure I suggested the solution as targeted by this patch.

...

> +		retain_and_null_ptr(pm);

Ah, I see, in such a case it might be better to leave the bare runtime PM
calls. Sorry for the suboptimal proposal.

-- 
With Best Regards,
Andy Shevchenko