Re: [PATCH v2] platform/chrome: cros_hps_i2c: fix use-after-free in release() after unbind

[Tzung-Bi Shih]

On Tue, Nov 10, 2026 at 12:32:40PM +0000, Chad Aldreda wrote:
>  static int hps_release(struct inode *inode, struct file *file)
>  {
> -	struct hps_drvdata *hps = container_of(file->private_data,
> -					       struct hps_drvdata, misc_device);
> -	struct device *dev = &hps->client->dev;
> +	struct hps_drvdata *hps = file->private_data;
>  
> -	pm_runtime_put(dev);
> +	mutex_lock(&hps->lock);
> +	if (!hps->removed) {
> +		hps->open_count--;
> +		pm_runtime_put(&hps->client->dev);

I realized we can use `hps->client` directly to tell whether the device has
detached (i.e., set `hps->client` to NULL in hps_i2c_remove()).

Could you respin the patch to use `hps->client` instead of the `removed`
flag?