Re: [PATCH v2 3/3] iio: humidity: hid-sensor-humidity: Use per-instance callbacks

[Jonathan Cameron]

On Wed,  7 Oct 2026 11:44:23 -0700
Christopher Hoover <ch@xxxxxxxxxxxxxx> wrote:

> hid-sensor-humidity keeps a single static struct
> hid_sensor_hub_callbacks for all instances and overwrites its pdev in
> every probe, so with two humidity sensors, input reports for one are
> delivered with the other's platform device, and a NULL dereference
> follows once that device is removed.  The same bug was found in
> hid-sensor-temperature, which shares this code.
> 
> Keep the callbacks in struct hid_humidity_state, as the other HID
> sensor drivers (accel, gyro, als, ...) do.
> 
> Fixes: d7ed89d5aadf ("iio: hid: Add humidity sensor support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christopher Hoover <ch@xxxxxxxxxxxxxx>
Hi Christopher,

Same suggestion as I made on patch 2 applies here.

Otherwise LGTM.  This one seems less likely to be a problem in
practice than the previous just because I can't imagine we have
devices out there with multiple humidity sensors! Still good to
fix in case they ever show up.

thanks,

Jonathan

> ---
>  drivers/iio/humidity/hid-sensor-humidity.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
> index 7cec81ff5685..95ee1d71c1a7 100644
> --- a/drivers/iio/humidity/hid-sensor-humidity.c
> +++ b/drivers/iio/humidity/hid-sensor-humidity.c
> @@ -14,6 +14,7 @@
>  
>  struct hid_humidity_state {
>  	struct hid_sensor_common common_attributes;
> +	struct hid_sensor_hub_callbacks callbacks;
>  	struct hid_sensor_hub_attribute_info humidity_attr;
>  	struct {
>  		s32 humidity_data;
> @@ -184,11 +185,6 @@ static int humidity_parse_report(struct platform_device *pdev,
>  	return ret;
>  }
>  
> -static struct hid_sensor_hub_callbacks humidity_callbacks = {
> -	.send_event = &humidity_proc_event,
> -	.capture_sample = &humidity_capture_sample,
> -};
> -
>  /* Function to initialize the processing for usage id */
>  static int hid_humidity_probe(struct platform_device *pdev)
>  {
> @@ -240,9 +236,11 @@ static int hid_humidity_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, indio_dev);
>  
> -	humidity_callbacks.pdev = pdev;
> +	humid_st->callbacks.send_event = humidity_proc_event;
> +	humid_st->callbacks.capture_sample = humidity_capture_sample;
> +	humid_st->callbacks.pdev = pdev;
>  	ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_HUMIDITY,
> -					   &humidity_callbacks);
> +					   &humid_st->callbacks);
>  	if (ret)
>  		goto error_remove_trigger;
>