Re: [PATCH v3 0/3] iio: hid-sensors: fix shared callbacks in temperature and humidity

[Christopher Hoover]

>> Dropped patch 1, that should go via the hid tre

Do i need to do that ?    Sorry for the possibly dumb question -- I'm
well out of practice with the process.

-ch

On Tue, Nov 10, 2026 at 6:53 PM Jonathan Cameron <jic23@xxxxxxxxxx> wrote:
>
> On Mon, 2 Nov 2026 21:56:06 +0000
> Jonathan Cameron <jic23@xxxxxxxxxx> wrote:
>
> > On Sun, 18 Oct 2026 19:34:17 -0700
> > Christopher Hoover <ch@xxxxxxxxxxxxxx> wrote:
> >
> > > hid-sensor-temperature and hid-sensor-humidity share one static
> > > struct hid_sensor_hub_callbacks across instances and overwrite its pdev
> > > on every probe. With two temperature sensors, reports for one go to
> > > the other's pdev; once that device is removed,
> > > temperature_capture_sample() dereferences NULL. I hit this on 7.0
> > > with two uhid-created sensors.
> > >
> > > Patches 2-3 make the callbacks per instance, as the other HID sensor
> > > drivers do. Patch 1 makes sensor_hub_remove_callback() take
> > > pdata->lock, as sensor_hub_raw_event() does, so a report racing an
> > > unbind cannot call through the freed callbacks.
> > Applied to the fixes-togreg branch of iio.git with the ordering tweaks Andy suggested.
>
> One day I'll remember some bits of this driver are in hid.
>
> Dropped patch 1, that should go via the hid tree.
>
> Sorry Jiri / Christopher.
>
> I only seem to notice I've done this whilst writing pull requests :(
>
> Jonathan
>
>
>
> >
> > Thanks,
> >
> > Jonathan
> > >
> > > Changes in v3:
> > > - Patches 2-3: set the callbacks with one compound literal (Jonathan).
> > > - Kept Joshua's Reviewed-by on all three; patches 2-3 changed only in
> > >   style.
> > > - Rebased onto v7.3.
> > > - Sent as a new thread, not a reply to v2.
> > >
> > > Changes in v2:
> > > - New patch 1, for the use-after-free on unbind found by the Sashiko
> > >   review of v1.
> > >
> > > v2: https://lore.kernel.org/all/20261007184423.622445-1-ch@xxxxxxxxxxxxxx/
> > >
> > > Christopher Hoover (3):
> > >   HID: hid-sensor-hub: Synchronize callback removal with raw events
> > >   iio: temperature: hid-sensor-temperature: Use per-instance callbacks
> > >   iio: humidity: hid-sensor-humidity: Use per-instance callbacks
> > >
> > >  drivers/hid/hid-sensor-hub.c                     | 12 ++++++++++--
> > >  drivers/iio/humidity/hid-sensor-humidity.c       | 14 +++++++-------
> > >  drivers/iio/temperature/hid-sensor-temperature.c | 14 +++++++-------
> > >  3 files changed, 24 insertions(+), 16 deletions(-)
> > >
> > >
> > > base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
> >
> >
>