iio_trigger_attach_poll_func() prints an error when all CONFIG_IIO_CONSUMERS_PER_TRIGGER irqs of the trigger are in use, but returns 0. The buffer of the extra consumer is enabled without a poll function. Disabling that buffer calls clear_bit() with a negative bit number and drops a module reference for the second time. On arm and arm64 the clear_bit() goes about 512 MB past the pool bitmap. That is an oops if the address is not mapped, and a bit cleared in unrelated memory if it is. Return the error from iio_trigger_get_irq(). Fixes: 995438233579 ("iio: Fix error handling in iio_trigger_attach_poll_func") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter --- Found with an experimental clang warning for a function that returns 0 right after it reports a failure. Tested in QEMU with three consumers on one hrtimer trigger and CONFIG_IIO_CONSUMERS_PER_TRIGGER=2. Without the patch the third write to buffer/enable returns 0. With it the write fails with -ENOMEM and the buffers are disabled without a message. Disabling the buffers without the patch: arm, vexpress-a9, st_magn on three emulated LSM303DLHC: Unable to handle kernel paging request at virtual address a1a2e690 when read PC is at _clear_bit+0x20/0x38 LR is at iio_trigger_detach_poll_func+0x88/0xdc arm64, virt with 256 MB, iio dummy devices: Unable to handle kernel paging request at virtual address ffff000020b94348 pc : iio_trigger_put_irq+0x4c/0x74 iio_trigger_detach_poll_func+0x4c/0x90 arm64 with 2 GB and x86_64 show no message. On x86_64 the reference count of the dummy driver module drops by one per round. drivers/iio/industrialio-trigger.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c index 17781c12bc85..09d3dfc9d812 100644 --- a/drivers/iio/industrialio-trigger.c +++ b/drivers/iio/industrialio-trigger.c @@ -293,6 +293,7 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig, if (pf->irq < 0) { pr_err("Could not find an available irq for trigger %s, CONFIG_IIO_CONSUMERS_PER_TRIGGER=%d limit might be exceeded\n", trig->name, CONFIG_IIO_CONSUMERS_PER_TRIGGER); + ret = pf->irq; goto out_put_module; } base-commit: e767a4ea70a3992c37ed604157d32f0dfbf9b1e3 -- 2.53.0