[PATCH] iio: buffer: Fix wait_queue not being removed

[PATCH] iio: buffer: Fix wait_queue not being removed

[Nuno Sá via B4 Relay]

From: Nuno Sá <nuno.sa@analog.com>

In the edge case where the IIO device is unregistered while we're
buffering, we were directly returning an error without removing the wait
queue. Instead, set 'ret' and break out of the loop.

Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
 drivers/iio/industrialio-buffer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index c6259213e150..a09c0d263d7f 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -228,8 +228,10 @@ static ssize_t iio_buffer_write(struct file *filp, const char __user *buf,
 	written = 0;
 	add_wait_queue(&rb->pollq, &wait);
 	do {
-		if (!indio_dev->info)
-			return -ENODEV;
+		if (!indio_dev->info) {
+			ret = -ENODEV;
+			break;
+		}
 
 		if (!iio_buffer_space_available(rb)) {
 			if (signal_pending(current)) {

---
base-commit: f52690c50893ef1504990199c8a2dfbb869f38c6
change-id: 20260216-iio-buffer-write-fix-31ddf8b2a4a0
--

Thanks!
- Nuno Sá

Re: [PATCH] iio: buffer: Fix wait_queue not being removed

[David Lechner]

On 2/16/26 7:24 AM, Nuno Sá via B4 Relay wrote:
> From: Nuno Sá <nuno.sa@analog.com>
> 
> In the edge case where the IIO device is unregistered while we're
> buffering, we were directly returning an error without removing the wait
> queue. Instead, set 'ret' and break out of the loop.
> 
> Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
> Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> ---
Reviewed-by: David Lechner <dlechner@baylibre.com>

Re: [PATCH] iio: buffer: Fix wait_queue not being removed

[Jonathan Cameron]

On Sat, 21 Feb 2026 15:27:42 -0600
David Lechner <dlechner@baylibre.com> wrote:

> On 2/16/26 7:24 AM, Nuno Sá via B4 Relay wrote:
> > From: Nuno Sá <nuno.sa@analog.com>
> > 
> > In the edge case where the IIO device is unregistered while we're
> > buffering, we were directly returning an error without removing the wait
> > queue. Instead, set 'ret' and break out of the loop.
> > 
> > Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
> > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> > ---  
> Reviewed-by: David Lechner <dlechner@baylibre.com>
> 
This brings the code inline with the near identical
flow in the read path.

It's been a while since I last looked at the locking / tear
down (what that ->info check is all about).  I'll add actually
documenting all the corner cases to the todo list as IIRC
there are some non obvious ordering constraints.  IIRC,
in the buffer paths, it is fairly straight forward
as it's just an optimization to avoid queuing or draining
data when the device is going down - nothing about the buffers
themselves involves interacting directly with the hardware.

Applied to the fixes-togreg branch of iio.git and marked
for stable.

Thanks,

Jonathan

Re: [PATCH] iio: buffer: Fix wait_queue not being removed

[Nuno Sá]

On Sun, 2026-02-22 at 12:37 +0000, Jonathan Cameron wrote:
> On Sat, 21 Feb 2026 15:27:42 -0600
> David Lechner <dlechner@baylibre.com> wrote:
> 
> > On 2/16/26 7:24 AM, Nuno Sá via B4 Relay wrote:
> > > From: Nuno Sá <nuno.sa@analog.com>
> > > 
> > > In the edge case where the IIO device is unregistered while we're
> > > buffering, we were directly returning an error without removing the wait
> > > queue. Instead, set 'ret' and break out of the loop.
> > > 
> > > Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
> > > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> > > ---  
> > Reviewed-by: David Lechner <dlechner@baylibre.com>
> > 
> This brings the code inline with the near identical
> flow in the read path.
> 
> It's been a while since I last looked at the locking / tear
> down (what that ->info check is all about).  I'll add actually

Yeah not sure if you remember but I already said this a couple of times. In the buffer
paths I'm not convinced the check we have is enough. Still very open to races AFAICT.
I have it in my list to try and trigger and actual issue/dump on that path so it's not just
theory. Already asked the bot to write some stressor/test code :).

> documenting all the corner cases to the todo list as IIRC
> there are some non obvious ordering constraints.  IIRC,
> in the buffer paths, it is fairly straight forward
> as it's just an optimization to avoid queuing or draining
> data when the device is going down - nothing about the buffers
> themselves involves interacting directly with the hardware.
> 
> Applied to the fixes-togreg branch of iio.git and marked
> for stable.
> 

BTW, I just realized we now have an Assisted-by: tag for getting help from AI. I should
say that this bug was identified by Claude code (when bulding the stressor test app I 
mentioned above :)). So, maybe (or can we Reported by: Claude Code?!!):

Assisted-by: Claude Code

- Nuno Sá

Re: [PATCH] iio: buffer: Fix wait_queue not being removed

[Andy Shevchenko]

On Mon, Feb 23, 2026 at 01:39:37PM +0000, Nuno Sá wrote:
> On Sun, 2026-02-22 at 12:37 +0000, Jonathan Cameron wrote:
> > On Sat, 21 Feb 2026 15:27:42 -0600
> > David Lechner <dlechner@baylibre.com> wrote:
> > 
> > > On 2/16/26 7:24 AM, Nuno Sá via B4 Relay wrote:
> > > > From: Nuno Sá <nuno.sa@analog.com>
> > > > 
> > > > In the edge case where the IIO device is unregistered while we're
> > > > buffering, we were directly returning an error without removing the wait
> > > > queue. Instead, set 'ret' and break out of the loop.
> > > > 
> > > > Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
> > > > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> > > > ---  
> > > Reviewed-by: David Lechner <dlechner@baylibre.com>
> > > 
> > This brings the code inline with the near identical
> > flow in the read path.
> > 
> > It's been a while since I last looked at the locking / tear
> > down (what that ->info check is all about).  I'll add actually
> 
> Yeah not sure if you remember but I already said this a couple of times. In the buffer
> paths I'm not convinced the check we have is enough. Still very open to races AFAICT.
> I have it in my list to try and trigger and actual issue/dump on that path so it's not just
> theory. Already asked the bot to write some stressor/test code :).

Perhaps also a good task for stress-ng? Ask Colin!

> > documenting all the corner cases to the todo list as IIRC
> > there are some non obvious ordering constraints.  IIRC,
> > in the buffer paths, it is fairly straight forward
> > as it's just an optimization to avoid queuing or draining
> > data when the device is going down - nothing about the buffers
> > themselves involves interacting directly with the hardware.
> > 
> > Applied to the fixes-togreg branch of iio.git and marked
> > for stable.
> 
> BTW, I just realized we now have an Assisted-by: tag for getting help from AI. I should
> say that this bug was identified by Claude code (when bulding the stressor test app I 
> mentioned above :)). So, maybe (or can we Reported by: Claude Code?!!):

> Assisted-by: Claude Code

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: buffer: Fix wait_queue not being removed

[Nuno Sá]

On Mon, 2026-02-23 at 17:05 +0200, Andy Shevchenko wrote:
> On Mon, Feb 23, 2026 at 01:39:37PM +0000, Nuno Sá wrote:
> > On Sun, 2026-02-22 at 12:37 +0000, Jonathan Cameron wrote:
> > > On Sat, 21 Feb 2026 15:27:42 -0600
> > > David Lechner <dlechner@baylibre.com> wrote:
> > > 
> > > > On 2/16/26 7:24 AM, Nuno Sá via B4 Relay wrote:
> > > > > From: Nuno Sá <nuno.sa@analog.com>
> > > > > 
> > > > > In the edge case where the IIO device is unregistered while we're
> > > > > buffering, we were directly returning an error without removing the wait
> > > > > queue. Instead, set 'ret' and break out of the loop.
> > > > > 
> > > > > Fixes: 9eeee3b0bf19 ("iio: Add output buffer support")
> > > > > Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> > > > > ---  
> > > > Reviewed-by: David Lechner <dlechner@baylibre.com>
> > > > 
> > > This brings the code inline with the near identical
> > > flow in the read path.
> > > 
> > > It's been a while since I last looked at the locking / tear
> > > down (what that ->info check is all about).  I'll add actually
> > 
> > Yeah not sure if you remember but I already said this a couple of times. In the buffer
> > paths I'm not convinced the check we have is enough. Still very open to races AFAICT.
> > I have it in my list to try and trigger and actual issue/dump on that path so it's not just
> > theory. Already asked the bot to write some stressor/test code :).
> 
> Perhaps also a good task for stress-ng? Ask Colin!

I would be surprised if there's a stressor for this :). We need to sample (read) an IIO buffer while
unbinding the device at the same tim. It might even be that some real issues only pop for some
specific HW (which provides different buffer knobs).

- Nuno Sá

> 
> > > documenting all the corner cases to the todo list as IIRC
> > > there are some non obvious ordering constraints.  IIRC,
> > > in the buffer paths, it is fairly straight forward
> > > as it's just an optimization to avoid queuing or draining
> > > data when the device is going down - nothing about the buffers
> > > themselves involves interacting directly with the hardware.
> > > 
> > > Applied to the fixes-togreg branch of iio.git and marked
> > > for stable.
> > 
> > BTW, I just realized we now have an Assisted-by: tag for getting help from AI. I should
> > say that this bug was identified by Claude code (when bulding the stressor test app I 
> > mentioned above :)). So, maybe (or can we Reported by: Claude Code?!!):
> 
> > Assisted-by: Claude Code