Re: [PATCH v3 0/3] iio: hid-sensors: fix shared callbacks in temperature and humidity

[Jonathan Cameron <jic23@kernel.org>]

On Mon, 2 Nov 2026 21:56:06 +0000
Jonathan Cameron <jic23@kernel.org> wrote:

> On Sun, 18 Oct 2026 19:34:17 -0700
> Christopher Hoover <ch@murgatroid.com> wrote:
> 
> > hid-sensor-temperature and hid-sensor-humidity share one static
> > struct hid_sensor_hub_callbacks across instances and overwrite its pdev
> > on every probe. With two temperature sensors, reports for one go to
> > the other's pdev; once that device is removed,
> > temperature_capture_sample() dereferences NULL. I hit this on 7.0
> > with two uhid-created sensors.
> > 
> > Patches 2-3 make the callbacks per instance, as the other HID sensor
> > drivers do. Patch 1 makes sensor_hub_remove_callback() take
> > pdata->lock, as sensor_hub_raw_event() does, so a report racing an
> > unbind cannot call through the freed callbacks.  
> Applied to the fixes-togreg branch of iio.git with the ordering tweaks Andy suggested.

One day I'll remember some bits of this driver are in hid.

Dropped patch 1, that should go via the hid tree.

Sorry Jiri / Christopher.

I only seem to notice I've done this whilst writing pull requests :(

Jonathan



> 
> Thanks,
> 
> Jonathan
> > 
> > Changes in v3:
> > - Patches 2-3: set the callbacks with one compound literal (Jonathan).
> > - Kept Joshua's Reviewed-by on all three; patches 2-3 changed only in
> >   style.
> > - Rebased onto v7.3.
> > - Sent as a new thread, not a reply to v2.
> > 
> > Changes in v2:
> > - New patch 1, for the use-after-free on unbind found by the Sashiko
> >   review of v1.
> > 
> > v2: https://lore.kernel.org/all/20261007184423.622445-1-ch@murgatroid.com/
> > 
> > Christopher Hoover (3):
> >   HID: hid-sensor-hub: Synchronize callback removal with raw events
> >   iio: temperature: hid-sensor-temperature: Use per-instance callbacks
> >   iio: humidity: hid-sensor-humidity: Use per-instance callbacks
> > 
> >  drivers/hid/hid-sensor-hub.c                     | 12 ++++++++++--
> >  drivers/iio/humidity/hid-sensor-humidity.c       | 14 +++++++-------
> >  drivers/iio/temperature/hid-sensor-temperature.c | 14 +++++++-------
> >  3 files changed, 24 insertions(+), 16 deletions(-)
> > 
> > 
> > base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222  
> 
>