[PATCH v3 0/2] iio: gyro: mpu3050: add missing trigger cleanup

[PATCH v3 0/2] iio: gyro: mpu3050: add missing trigger cleanup

[Joshua Crofts]

This series fixes an ignored error return value that causes the device
to behave in a weird polling state and a subsequent use-after-free bug
reported by Dingisoul.

Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
Changes in v3:
- Add a separate patch addressing the missing goto on trigger register
  failure
- Link to v2: https://lore.kernel.org/r/20261015-mpu3050-fix-v2-1-53f73581e62c@gmail.com

Changes in v2:
- Add a local struct iio_trigger and assign it to the data struct only
  after a successful IRQ request to prevent a null pointer deref as
  pointed out by Sashiko
- Link to v1: https://lore.kernel.org/r/20261011-mpu3050-fix-v1-1-f55b0d138be4@gmail.com

---
Joshua Crofts (2):
      iio: gyro: mpu3050: fail probe() on trigger registration failure
      iio: gyro: mpu3050: add missing trigger cleanup on remove()

 drivers/iio/gyro/mpu3050-core.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
---
base-commit: a3b3580713f3ac5a32dc2874ee546828977a1d68
change-id: 20261011-mpu3050-fix-145a77d5229b

Best regards,
-- 
Joshua Crofts

[PATCH v3 1/2] iio: gyro: mpu3050: fail probe() on trigger registration failure

[Joshua Crofts]

The current implementation lets mpu3050_common_probe() continue on trigger
registration failure, causing the device to operate in an odd polling mode
and making resource management harder.

Jump to the error handling logic if the trigger failed to register.

Suggested-by: Nuno Sá <nuno.sa@analog.com>
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: <stable@vger.kernel.org>
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
 drivers/iio/gyro/mpu3050-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index 07c0f9011c63..879caf3b729c 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1231,8 +1231,10 @@ int mpu3050_common_probe(struct device *dev,
 	/* Check if we have an assigned IRQ to use as trigger */
 	if (irq) {
 		ret = mpu3050_trigger_probe(indio_dev, irq);
-		if (ret)
+		if (ret) {
 			dev_err(dev, "failed to register trigger\n");
+			goto err_cleanup_buffer;
+		}
 	}
 
 	/* Enable runtime PM */
@@ -1262,6 +1264,7 @@ int mpu3050_common_probe(struct device *dev,
 	pm_runtime_disable(dev);
 	if (irq)
 		free_irq(mpu3050->irq, mpu3050->trig);
+err_cleanup_buffer:
 	iio_triggered_buffer_cleanup(indio_dev);
 err_power_down:
 	mpu3050_power_down(mpu3050);

-- 
2.56.0

[PATCH v3 2/2] iio: gyro: mpu3050: add missing trigger cleanup on remove()

[Joshua Crofts]

The mpu3050_trigger_probe() registers a trigger but
mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
to clean it up, causing a use-after-free bug.

Add the missing calls to the iio_trigger_unregister() function.

Reported-by: Dingisoul <dingiso.kernel@gmail.com>
Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@gmail.com/
Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
 drivers/iio/gyro/mpu3050-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index 879caf3b729c..9e747836df3e 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -1262,7 +1262,9 @@ int mpu3050_common_probe(struct device *dev,
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);
-	if (irq)
+	if (mpu3050->trig)
+		iio_trigger_unregister(mpu3050->trig);
+	if (mpu3050->irq)
 		free_irq(mpu3050->irq, mpu3050->trig);
 err_cleanup_buffer:
 	iio_triggered_buffer_cleanup(indio_dev);
@@ -1281,6 +1283,8 @@ void mpu3050_common_remove(struct device *dev)
 	pm_runtime_get_sync(dev);
 	pm_runtime_put_noidle(dev);
 	pm_runtime_disable(dev);
+	if (mpu3050->trig)
+		iio_trigger_unregister(mpu3050->trig);
 	if (mpu3050->irq)
 		free_irq(mpu3050->irq, mpu3050->trig);
 	iio_triggered_buffer_cleanup(indio_dev);

-- 
2.56.0

Re: [PATCH v3 2/2] iio: gyro: mpu3050: add missing trigger cleanup on remove()

[Nuno Sá]

On Sat, Oct 17, 2026 at 07:19:21AM +0200, Joshua Crofts wrote:
> The mpu3050_trigger_probe() registers a trigger but
> mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> to clean it up, causing a use-after-free bug.
> 
> Add the missing calls to the iio_trigger_unregister() function.
> 
> Reported-by: Dingisoul <dingiso.kernel@gmail.com>
> Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@gmail.com/
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@vger.kernel.org
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
>  drivers/iio/gyro/mpu3050-core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
> index 879caf3b729c..9e747836df3e 100644
> --- a/drivers/iio/gyro/mpu3050-core.c
> +++ b/drivers/iio/gyro/mpu3050-core.c
> @@ -1262,7 +1262,9 @@ int mpu3050_common_probe(struct device *dev,
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> -	if (irq)
> +	if (mpu3050->trig)
> +		iio_trigger_unregister(mpu3050->trig);

Yeah, I think sashiko is right... I think we can just reuse the if
(mpu3050->irq) condition for unregistering  but then this patch depends
on the previous one. And such dependencies can be set for stable so
don't think it's an issue.

I already pointed it out and Jonathan seems to have said the same. If
you do have the time, converting the whole thing to devm would be nice 
- could be patch 3 :)

- Nuno Sá

> +	if (mpu3050->irq)
>  		free_irq(mpu3050->irq, mpu3050->trig);
>  err_cleanup_buffer:
>  	iio_triggered_buffer_cleanup(indio_dev);
> @@ -1281,6 +1283,8 @@ void mpu3050_common_remove(struct device *dev)
>  	pm_runtime_get_sync(dev);
>  	pm_runtime_put_noidle(dev);
>  	pm_runtime_disable(dev);
> +	if (mpu3050->trig)
> +		iio_trigger_unregister(mpu3050->trig);
>  	if (mpu3050->irq)
>  		free_irq(mpu3050->irq, mpu3050->trig);
>  	iio_triggered_buffer_cleanup(indio_dev);
> 
> -- 
> 2.56.0
> 

Re: [PATCH v3 2/2] iio: gyro: mpu3050: add missing trigger cleanup on remove()

[Joshua Crofts]

On Mon, 19 Oct 2026 11:54:41 +0100
Nuno Sá <nuno.sa@analog.com> wrote:

> On Sat, Oct 17, 2026 at 07:19:21AM +0200, Joshua Crofts wrote:
> > The mpu3050_trigger_probe() registers a trigger but
> > mpu3050_common_remove() and error paths in mpu3050_common_probe() forget
> > to clean it up, causing a use-after-free bug.
> > 
> > Add the missing calls to the iio_trigger_unregister() function.
> > 
> > Reported-by: Dingisoul <dingiso.kernel@gmail.com>
> > Closes: https://lore.kernel.org/all/20261010203601.1686148-1-dingiso.kernel@gmail.com/
> > Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> > ---
> >  drivers/iio/gyro/mpu3050-core.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
> > index 879caf3b729c..9e747836df3e 100644
> > --- a/drivers/iio/gyro/mpu3050-core.c
> > +++ b/drivers/iio/gyro/mpu3050-core.c
> > @@ -1262,7 +1262,9 @@ int mpu3050_common_probe(struct device *dev,
> >  	pm_runtime_get_sync(dev);
> >  	pm_runtime_put_noidle(dev);
> >  	pm_runtime_disable(dev);
> > -	if (irq)
> > +	if (mpu3050->trig)
> > +		iio_trigger_unregister(mpu3050->trig);  
> 
> Yeah, I think sashiko is right... I think we can just reuse the if
> (mpu3050->irq) condition for unregistering  but then this patch depends
> on the previous one. And such dependencies can be set for stable so
> don't think it's an issue.
> 
> I already pointed it out and Jonathan seems to have said the same. If
> you do have the time, converting the whole thing to devm would be nice 
> - could be patch 3 :)

Bad time to be lazy :P I'll have a look.

-- 
Kind regards,
Joshua Crofts

Re: [PATCH v3 0/2] iio: gyro: mpu3050: add missing trigger cleanup

[Jonathan Cameron]

On Sat, 17 Oct 2026 07:19:19 +0200
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

> This series fixes an ignored error return value that causes the device
> to behave in a weird polling state and a subsequent use-after-free bug
> reported by Dingisoul.
> 
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Not sure where signing off on cover letters came from. There is no need
as they don't form part of the permanent git record so DCO doesn't apply.

Series looks fine to me but given others have been actively responding
to previous versions I'll leave it a while to pick up some tags.

Thanks,

Jonathan

> ---
> Changes in v3:
> - Add a separate patch addressing the missing goto on trigger register
>   failure
> - Link to v2: https://lore.kernel.org/r/20261015-mpu3050-fix-v2-1-53f73581e62c@gmail.com
> 
> Changes in v2:
> - Add a local struct iio_trigger and assign it to the data struct only
>   after a successful IRQ request to prevent a null pointer deref as
>   pointed out by Sashiko
> - Link to v1: https://lore.kernel.org/r/20261011-mpu3050-fix-v1-1-f55b0d138be4@gmail.com
> 
> ---
> Joshua Crofts (2):
>       iio: gyro: mpu3050: fail probe() on trigger registration failure
>       iio: gyro: mpu3050: add missing trigger cleanup on remove()
> 
>  drivers/iio/gyro/mpu3050-core.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> ---
> base-commit: a3b3580713f3ac5a32dc2874ee546828977a1d68
> change-id: 20261011-mpu3050-fix-145a77d5229b
> 
> Best regards,

Re: [PATCH v3 0/2] iio: gyro: mpu3050: add missing trigger cleanup

[Joshua Crofts]

On Sat, 17 Oct 2026 19:21:51 +0100
Jonathan Cameron <jic23@kernel.org> wrote:

> On Sat, 17 Oct 2026 07:19:19 +0200
> Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> 
> > This series fixes an ignored error return value that causes the device
> > to behave in a weird polling state and a subsequent use-after-free bug
> > reported by Dingisoul.
> > 
> > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>  
> Not sure where signing off on cover letters came from. There is no need
> as they don't form part of the permanent git record so DCO doesn't apply.

This is actually done by b4 automatically when creating a cover letter.

> Series looks fine to me but given others have been actively responding
> to previous versions I'll leave it a while to pick up some tags.

Sashiko had a remark about there still being a possibility of a UAF so
I'll have to check that out either way.

-- 
Kind regards,
Joshua Crofts

Re: [PATCH v3 0/2] iio: gyro: mpu3050: add missing trigger cleanup

[Andy Shevchenko]

On Sat, Oct 17, 2026 at 07:21:51PM +0100, Jonathan Cameron wrote:
> On Sat, 17 Oct 2026 07:19:19 +0200
> Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> 
> > This series fixes an ignored error return value that causes the device
> > to behave in a weird polling state and a subsequent use-after-free bug
> > reported by Dingisoul.
> > 
> > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> Not sure where signing off on cover letters came from. There is no need
> as they don't form part of the permanent git record so DCO doesn't apply.

It may. I often use `b4 shazam` for the series, and cover letter become
a content of the merge-commit in such a case, so I'm fully for SoB of
the cover letters.

> Series looks fine to me but given others have been actively responding
> to previous versions I'll leave it a while to pick up some tags.

-- 
With Best Regards,
Andy Shevchenko