Re: [PATCH v3 0/3] iio: hid-sensors: fix shared callbacks in temperature and humidity

[Jonathan Cameron]

On Sun, 18 Oct 2026 19:34:17 -0700
Christopher Hoover <ch@xxxxxxxxxxxxxx> wrote:

> hid-sensor-temperature and hid-sensor-humidity share one static
> struct hid_sensor_hub_callbacks across instances and overwrite its pdev
> on every probe. With two temperature sensors, reports for one go to
> the other's pdev; once that device is removed,
> temperature_capture_sample() dereferences NULL. I hit this on 7.0
> with two uhid-created sensors.
> 
> Patches 2-3 make the callbacks per instance, as the other HID sensor
> drivers do. Patch 1 makes sensor_hub_remove_callback() take
> pdata->lock, as sensor_hub_raw_event() does, so a report racing an
> unbind cannot call through the freed callbacks.
Applied to the fixes-togreg branch of iio.git with the ordering tweaks Andy suggested.

Thanks,

Jonathan
> 
> Changes in v3:
> - Patches 2-3: set the callbacks with one compound literal (Jonathan).
> - Kept Joshua's Reviewed-by on all three; patches 2-3 changed only in
>   style.
> - Rebased onto v7.3.
> - Sent as a new thread, not a reply to v2.
> 
> Changes in v2:
> - New patch 1, for the use-after-free on unbind found by the Sashiko
>   review of v1.
> 
> v2: https://lore.kernel.org/all/20261007184423.622445-1-ch@xxxxxxxxxxxxxx/
> 
> Christopher Hoover (3):
>   HID: hid-sensor-hub: Synchronize callback removal with raw events
>   iio: temperature: hid-sensor-temperature: Use per-instance callbacks
>   iio: humidity: hid-sensor-humidity: Use per-instance callbacks
> 
>  drivers/hid/hid-sensor-hub.c                     | 12 ++++++++++--
>  drivers/iio/humidity/hid-sensor-humidity.c       | 14 +++++++-------
>  drivers/iio/temperature/hid-sensor-temperature.c | 14 +++++++-------
>  3 files changed, 24 insertions(+), 16 deletions(-)
> 
> 
> base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222