[PATCH v2 2/3] iio: temperature: hid-sensor-temperature: Use per-instance callbacks
flat view
WARM3d
From: Christopher Hoover <hidden>
Date: 2026-10-07 18:55:28
Also in:
linux-iio, lkml, stable
Subsystem:
hid sensor hub drivers, iio subsystem and drivers, the rest · Maintainers:
Jiri Kosina, Jonathan Cameron, Srinivas Pandruvada, Linus Torvalds
Revision v2 of 2 in this series.
Revisions (2)
- v1 [diff vs current]
- v2 current
hid-sensor-temperature keeps a single static struct
hid_sensor_hub_callbacks for all instances and overwrites its pdev in
every probe. With two temperature sensors, input reports for one are
delivered with the other's platform device; once that device is
removed, platform_get_drvdata() returns NULL and
temperature_capture_sample() dereferences it:
BUG: kernel NULL pointer dereference, address: 00000000000003a8
RIP: 0010:temperature_capture_sample+0xd/0x50 [hid_sensor_temperature]
The oops happens in sensor_hub_raw_event() with the hub's spinlock
held, so the hub's removal then hangs. It reproduces with two uhid
devices that each declare a temperature sensor, one destroyed while
the other still sends input reports.
Keep the callbacks in struct temperature_state, as the other HID
sensor drivers (accel, gyro, als, ...) do.
Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Christopher Hoover <redacted>
---
drivers/iio/temperature/hid-sensor-temperature.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index 5e3262e461f4..35b8643305b9 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c@@ -14,6 +14,7 @@ struct temperature_state { struct hid_sensor_common common_attributes; + struct hid_sensor_hub_callbacks callbacks; struct hid_sensor_hub_attribute_info temperature_attr; struct { s32 temperature_data;
@@ -181,11 +182,6 @@ static int temperature_parse_report(struct platform_device *pdev, return ret; } -static struct hid_sensor_hub_callbacks temperature_callbacks = { - .send_event = &temperature_proc_event, - .capture_sample = &temperature_capture_sample, -}; - /* Function to initialize the processing for usage id */ static int hid_temperature_probe(struct platform_device *pdev) {
@@ -237,9 +233,11 @@ static int hid_temperature_probe(struct platform_device *pdev) platform_set_drvdata(pdev, indio_dev); - temperature_callbacks.pdev = pdev; + temp_st->callbacks.send_event = temperature_proc_event; + temp_st->callbacks.capture_sample = temperature_capture_sample; + temp_st->callbacks.pdev = pdev; ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE, - &temperature_callbacks); + &temp_st->callbacks); if (ret) goto error_remove_trigger;
--
2.43.0