RE: [PATCH v2 0/7] HID: sensor: custom: use-after-freec after remove

[Zhang, Lixu]

>-----Original Message-----
>From: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>
>Sent: Thursday, November 5, 2026 4:14 AM
>To: jikos@xxxxxxxxxx; jic23@xxxxxxxxxx; bentiss@xxxxxxxxxx
>Cc: linux-input@xxxxxxxxxxxxxxx; linux-iio@xxxxxxxxxxxxxxx; linux-
>kernel@xxxxxxxxxxxxxxx; simeon@xxxxxxxxxxxxx; Zhang, Lixu
><lixu.zhang@xxxxxxxxx>; crofts@xxxxxxxxxx; Srinivas Pandruvada
><srinivas.pandruvada@xxxxxxxxxxxxxxx>
>Subject: [PATCH v2 0/7] HID: sensor: custom: use-after-freec after remove
>
>This is v2 for patch " [PATCH] HID: sensor-custom: Synchronize misc-device
>teardown with file lifetime".
>
>This patch series is essentially the same version that was sent to Семён for
>testing.
>
>Following a feedback review conducted with various AI models, it was
>suggested to break each change into individual, separate patches. This makes
>perfect sense, which is why this series now contains more patches.
>
>Additionally, these reviews identified issues in the adjacent probe and removal
>code when active sensor instances are present. I have addressed those issues in
>this version as well.

Hi,

I tested this series on a Panther Lake platform with Intel ISH.

1. The reported use-after-free and hard-lockup issue is no longer
   reproducible with this series applied.
2. During testing, patch 3 ("HID: sensor: custom: Disable sensor before
   hub close on removal") also exposed a pre-existing bug in
   intel-ish-hid: ishtp_cl_device_remove() clears device->event_cb
   before calling driver->remove(), causing synchronous sensor
   power-down commands during module unload to hit 3-second "timeout
   waiting for response from ISHTP device" errors. I will send a
   separate patch for intel-ish-hid to fix that.
3. Basic sensor functional tests also passed with no regressions found.

For the series:
Tested-by: Zhang Lixu <lixu.zhang@xxxxxxxxx>

Best regards,
Lixu

>
>Srinivas Pandruvada (7):
>  HID: sensor: hub: Synchronize callback removal with raw events
>  HID: sensor: custom: Set owner for misc device
>  HID: sensor: custom: Disable sensor before hub close on removal
>  HID: sensor: custom: Fix state lifetime during removal
>  HID: sensor: custom: Serialize misc device reads
>  HID: sensor: custom: Register enable attribute after misc device
>  HID: sensor: hub: Remove clients before stopping hardware
>
> drivers/hid/hid-sensor-custom.c | 121 +++++++++++++++++++++++---------
> drivers/hid/hid-sensor-hub.c    |  27 +++++--
> 2 files changed, 110 insertions(+), 38 deletions(-)
>
>--
>2.56.0