Re: [PATCH v3 2/3] iio: temperature: hid-sensor-temperature: Use per-instance callbacks

[srinivas pandruvada]

On Sun, 2026-10-18 at 19:34 -0700, Christopher Hoover wrote:
> hid-sensor-temperature keeps a single static struct
> hid_sensor_hub_callbacks for all instances and overwrites its pdev in
> every probe.  With two temperature sensors, input reports for one are
> delivered with the other's platform device; once that device is
> removed, platform_get_drvdata() returns NULL and
> temperature_capture_sample() dereferences it:
> 
>   BUG: kernel NULL pointer dereference, address: 00000000000003a8
>   RIP: 0010:temperature_capture_sample+0xd/0x50
> [hid_sensor_temperature]
> 
> The oops happens in sensor_hub_raw_event() with the hub's spinlock
> held, so the hub's removal then hangs.  It reproduces with two uhid
> devices that each declare a temperature sensor, one destroyed while
> the other still sends input reports.
> 
> Keep the callbacks in struct temperature_state, as the other HID
> sensor drivers (accel, gyro, als, ...) do.
> 
> Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christopher Hoover <ch@xxxxxxxxxxxxxx>
> Reviewed-by: Joshua Crofts <joshua.crofts1@xxxxxxxxx>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

> ---
>  drivers/iio/temperature/hid-sensor-temperature.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c
> b/drivers/iio/temperature/hid-sensor-temperature.c
> index 5e3262e461f4..4bc9d42a0301 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c
> @@ -14,6 +14,7 @@
>  
>  struct temperature_state {
>  	struct hid_sensor_common common_attributes;
> +	struct hid_sensor_hub_callbacks callbacks;
>  	struct hid_sensor_hub_attribute_info temperature_attr;
>  	struct {
>  		s32 temperature_data;
> @@ -181,11 +182,6 @@ static int temperature_parse_report(struct
> platform_device *pdev,
>  	return ret;
>  }
>  
> -static struct hid_sensor_hub_callbacks temperature_callbacks = {
> -	.send_event = &temperature_proc_event,
> -	.capture_sample = &temperature_capture_sample,
> -};
> -
>  /* Function to initialize the processing for usage id */
>  static int hid_temperature_probe(struct platform_device *pdev)
>  {
> @@ -237,9 +233,13 @@ static int hid_temperature_probe(struct
> platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, indio_dev);
>  
> -	temperature_callbacks.pdev = pdev;
> +	temp_st->callbacks = (struct hid_sensor_hub_callbacks) {
> +		.send_event = temperature_proc_event,
> +		.capture_sample = temperature_capture_sample,
> +		.pdev = pdev,
> +	};
>  	ret = sensor_hub_register_callback(hsdev,
> HID_USAGE_SENSOR_TEMPERATURE,
> -					   &temperature_callbacks);
> +					   &temp_st->callbacks);
>  	if (ret)
>  		goto error_remove_trigger;
>