Re: [PATCH v2 2/3] iio: temperature: hid-sensor-temperature: Use per-instance callbacks

[Jonathan Cameron]

On Wed,  7 Oct 2026 11:44:22 -0700
Christopher Hoover <ch@xxxxxxxxxxxxxx> wrote:

> hid-sensor-temperature keeps a single static struct
> hid_sensor_hub_callbacks for all instances and overwrites its pdev in
> every probe.  With two temperature sensors, input reports for one are
> delivered with the other's platform device; once that device is
> removed, platform_get_drvdata() returns NULL and
> temperature_capture_sample() dereferences it:
> 
>   BUG: kernel NULL pointer dereference, address: 00000000000003a8
>   RIP: 0010:temperature_capture_sample+0xd/0x50 [hid_sensor_temperature]
> 
> The oops happens in sensor_hub_raw_event() with the hub's spinlock
> held, so the hub's removal then hangs.  It reproduces with two uhid
> devices that each declare a temperature sensor, one destroyed while
> the other still sends input reports.
> 
> Keep the callbacks in struct temperature_state, as the other HID
> sensor drivers (accel, gyro, als, ...) do.
> 
> Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christopher Hoover <ch@xxxxxxxxxxxxxx>
Good find. Ouch.

One trivial suggestion inline that I think makes the change
a tiny bit more readable.

> ---
>  drivers/iio/temperature/hid-sensor-temperature.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
> index 5e3262e461f4..35b8643305b9 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c
> @@ -14,6 +14,7 @@
>  
>  struct temperature_state {
>  	struct hid_sensor_common common_attributes;
> +	struct hid_sensor_hub_callbacks callbacks;
>  	struct hid_sensor_hub_attribute_info temperature_attr;
>  	struct {
>  		s32 temperature_data;
> @@ -181,11 +182,6 @@ static int temperature_parse_report(struct platform_device *pdev,
>  	return ret;
>  }
>  
> -static struct hid_sensor_hub_callbacks temperature_callbacks = {
> -	.send_event = &temperature_proc_event,
> -	.capture_sample = &temperature_capture_sample,
> -};
> -
>  /* Function to initialize the processing for usage id */
>  static int hid_temperature_probe(struct platform_device *pdev)
>  {
> @@ -237,9 +233,11 @@ static int hid_temperature_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, indio_dev);
>  
> -	temperature_callbacks.pdev = pdev;
> +	temp_st->callbacks.send_event = temperature_proc_event;
> +	temp_st->callbacks.capture_sample = temperature_capture_sample;
> +	temp_st->callbacks.pdev = pdev;

	temp_st->callbacks = (struct hid_sensor_hub_callbacks) {
		.send_event = temperature_proc_event,
		.capture_sample = temperature_capture_sample,
		.pdev = pdev,
	};

>  	ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE,
> -					   &temperature_callbacks);
> +					   &temp_st->callbacks);
>  	if (ret)
>  		goto error_remove_trigger;
>