patch "iio: trigger: Fix reference counting" added to char-misc-linus

This is a note to let you know that I've just added the patch titled

iio: trigger: Fix reference counting

to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From a827a4984664308f13599a0b26c77018176d0c7c Mon Sep 17 00:00:00 2001
From: Lars-Peter Clausen <[email protected]>
Date: Sun, 24 Oct 2021 11:27:00 +0200
Subject: iio: trigger: Fix reference counting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In viio_trigger_alloc() device_initialize() is used to set the initial reference count of the trigger to 1. Then another get_device() is called on trigger. This sets the reference count to 2 before the trigger is returned.

iio_trigger_free(), which is the matching API to viio_trigger_alloc(), calls put_device() which decreases the reference count by 1. But the second reference count acquired in viio_trigger_alloc() is never dropped.

As a result the iio_trigger_release() function is never called and the memory associated with the trigger is never freed.

Since there is no reason for the trigger to start its lifetime with two reference counts just remove the extra get_device() in viio_trigger_alloc().

---
 drivers/iio/industrialio-trigger.c | 1 -
 1 file changed, 1 deletion(-)

index b23caa2f2aa1..93990ff1dfe3 100644
@@ -556,7 +556,6 @@ struct iio_trigger *viio_trigger_alloc(struct device *parent,
 		irq_modify_status(trig->subirq_base + i,
 				  IRQ_NOREQUEST | IRQ_NOAUTOEN, IRQ_NOPROBE);
 	}
-	get_device(&trig->dev);
 
 	return trig;
 

2.34.1