Re: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor

[Jiri Kosina]

On Tue, 7 Jul 2026, Haoxiang Li wrote:

> enable_sensor_store() can call set_power_report_state(), which
> dereferences sensor_inst->power_state and sensor_inst->report_state.
> These pointers refer to entries in sensor_inst->fields.
> 
> Create the field attributes before exposing the enable_sensor sysfs
> attribute, so enable_sensor cannot be accessed before the state it
> depends on has been initialized.
> 
> On remove, delete enable_sensor before freeing the field attributes,
> so a concurrent sysfs write cannot dereference freed memory through
> power_state or report_state.
> 
> Reported-by: Sashiko AI Review <sashiko-bot@xxxxxxxxxx>
> Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@xxxxxxx?part=1
> Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Haoxiang Li <haoxiang_li2024@xxxxxxx>

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs