Re: [PATCH v3 0/3] iio: hid-sensors: fix shared callbacks in temperature and humidity

[Jonathan Cameron <jic23@kernel.org>]

On Tue, 10 Nov 2026 19:11:31 -0800
Christopher Hoover <ch@murgatroid.com> wrote:

> >> Dropped patch 1, that should go via the hid tre  
> 
> Do i need to do that ?    Sorry for the possibly dumb question -- I'm
> well out of practice with the process.
Ideally Jiri will notice this thread and pick it up.

If that is looking unlikely by say rc5 then send a new version
with just that patch so that it stands out a little better

Thanks,

Jonathan

> 
> -ch
> 
> On Tue, Nov 10, 2026 at 6:53 PM Jonathan Cameron <jic23@kernel.org> wrote:
> >
> > On Mon, 2 Nov 2026 21:56:06 +0000
> > Jonathan Cameron <jic23@kernel.org> wrote:
> >  
> > > On Sun, 18 Oct 2026 19:34:17 -0700
> > > Christopher Hoover <ch@murgatroid.com> wrote:
> > >  
> > > > hid-sensor-temperature and hid-sensor-humidity share one static
> > > > struct hid_sensor_hub_callbacks across instances and overwrite its pdev
> > > > on every probe. With two temperature sensors, reports for one go to
> > > > the other's pdev; once that device is removed,
> > > > temperature_capture_sample() dereferences NULL. I hit this on 7.0
> > > > with two uhid-created sensors.
> > > >
> > > > Patches 2-3 make the callbacks per instance, as the other HID sensor
> > > > drivers do. Patch 1 makes sensor_hub_remove_callback() take
> > > > pdata->lock, as sensor_hub_raw_event() does, so a report racing an
> > > > unbind cannot call through the freed callbacks.  
> > > Applied to the fixes-togreg branch of iio.git with the ordering tweaks Andy suggested.  
> >
> > One day I'll remember some bits of this driver are in hid.
> >
> > Dropped patch 1, that should go via the hid tree.
> >
> > Sorry Jiri / Christopher.
> >
> > I only seem to notice I've done this whilst writing pull requests :(
> >
> > Jonathan
> >
> >
> >  
> > >
> > > Thanks,
> > >
> > > Jonathan  
> > > >
> > > > Changes in v3:
> > > > - Patches 2-3: set the callbacks with one compound literal (Jonathan).
> > > > - Kept Joshua's Reviewed-by on all three; patches 2-3 changed only in
> > > >   style.
> > > > - Rebased onto v7.3.
> > > > - Sent as a new thread, not a reply to v2.
> > > >
> > > > Changes in v2:
> > > > - New patch 1, for the use-after-free on unbind found by the Sashiko
> > > >   review of v1.
> > > >
> > > > v2: https://lore.kernel.org/all/20261007184423.622445-1-ch@murgatroid.com/
> > > >
> > > > Christopher Hoover (3):
> > > >   HID: hid-sensor-hub: Synchronize callback removal with raw events
> > > >   iio: temperature: hid-sensor-temperature: Use per-instance callbacks
> > > >   iio: humidity: hid-sensor-humidity: Use per-instance callbacks
> > > >
> > > >  drivers/hid/hid-sensor-hub.c                     | 12 ++++++++++--
> > > >  drivers/iio/humidity/hid-sensor-humidity.c       | 14 +++++++-------
> > > >  drivers/iio/temperature/hid-sensor-temperature.c | 14 +++++++-------
> > > >  3 files changed, 24 insertions(+), 16 deletions(-)
> > > >
> > > >
> > > > base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222  
> > >
> > >  
> >