Re: [PATCH v3 3/3] iio: humidity: hid-sensor-humidity: Use per-instance callbacks

[srinivas pandruvada]

On Sun, 2026-10-18 at 19:34 -0700, Christopher Hoover wrote:
> hid-sensor-humidity keeps a single static struct
> hid_sensor_hub_callbacks for all instances and overwrites its pdev in
> every probe, so with two humidity sensors, input reports for one are
> delivered with the other's platform device, and a NULL dereference
> follows once that device is removed.  The same bug was found in
> hid-sensor-temperature, which shares this code.
> 
> Keep the callbacks in struct hid_humidity_state, as the other HID
> sensor drivers (accel, gyro, als, ...) do.
> 
> Fixes: d7ed89d5aadf ("iio: hid: Add humidity sensor support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christopher Hoover <ch@xxxxxxxxxxxxxx>
> Reviewed-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

> ---
>  drivers/iio/humidity/hid-sensor-humidity.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/humidity/hid-sensor-humidity.c
> b/drivers/iio/humidity/hid-sensor-humidity.c
> index 7cec81ff5685..644c82719447 100644
> --- a/drivers/iio/humidity/hid-sensor-humidity.c
> +++ b/drivers/iio/humidity/hid-sensor-humidity.c
> @@ -14,6 +14,7 @@
>  
>  struct hid_humidity_state {
>  	struct hid_sensor_common common_attributes;
> +	struct hid_sensor_hub_callbacks callbacks;
>  	struct hid_sensor_hub_attribute_info humidity_attr;
>  	struct {
>  		s32 humidity_data;
> @@ -184,11 +185,6 @@ static int humidity_parse_report(struct
> platform_device *pdev,
>  	return ret;
>  }
>  
> -static struct hid_sensor_hub_callbacks humidity_callbacks = {
> -	.send_event = &humidity_proc_event,
> -	.capture_sample = &humidity_capture_sample,
> -};
> -
>  /* Function to initialize the processing for usage id */
>  static int hid_humidity_probe(struct platform_device *pdev)
>  {
> @@ -240,9 +236,13 @@ static int hid_humidity_probe(struct
> platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, indio_dev);
>  
> -	humidity_callbacks.pdev = pdev;
> +	humid_st->callbacks = (struct hid_sensor_hub_callbacks) {
> +		.send_event = humidity_proc_event,
> +		.capture_sample = humidity_capture_sample,
> +		.pdev = pdev,
> +	};
>  	ret = sensor_hub_register_callback(hsdev,
> HID_USAGE_SENSOR_HUMIDITY,
> -					   &humidity_callbacks);
> +					   &humid_st->callbacks);
>  	if (ret)
>  		goto error_remove_trigger;
>