[PATCH 0/9] HID: iio: Fix race condition between callback registration and device exposure

Sanjay Chitroda posted 9 patches 1 day, 17 hours ago
drivers/iio/accel/hid-sensor-accel-3d.c          | 20 ++++++++++----------
drivers/iio/gyro/hid-sensor-gyro-3d.c            | 20 ++++++++++----------
drivers/iio/light/hid-sensor-als.c               | 20 ++++++++++----------
drivers/iio/light/hid-sensor-prox.c              | 20 ++++++++++----------
drivers/iio/magnetometer/hid-sensor-magn-3d.c    | 20 ++++++++++----------
drivers/iio/orientation/hid-sensor-incl-3d.c     | 20 ++++++++++----------
drivers/iio/orientation/hid-sensor-rotation.c    | 20 ++++++++++----------
drivers/iio/pressure/hid-sensor-press.c          | 20 ++++++++++----------
drivers/iio/temperature/hid-sensor-temperature.c |  3 ++-
9 files changed, 82 insertions(+), 81 deletions(-)
[PATCH 0/9] HID: iio: Fix race condition between callback registration and device exposure
Posted by Sanjay Chitroda 1 day, 17 hours ago
Hi all,

This series fixes a race condition in HID IIO drivers related to the
ordering between callback registration and device exposure.

Currently, several HID IIO drivers register the IIO device (making it
visible to userspace and other kernel consumers) before all required
callbacks and resources are fully initialized, or rely on devm-based
cleanup in a way that does not guarantee correct teardown ordering.
This creates a window where the device can be accessed while it is
not fully initialized or is being torn down, potentially leading NULL
dereference or use-after-free.

To address this, the series ensures that:
  - All required callbacks and resources are set up before the device
    is registered with the IIO core
  - Resource cleanup is performed explicitly where ordering matters

PS: This is prepratory series to convert all HID IIO driver to devm.

Testing:
  - Compiled with W=1 for each patch in series
  - Build-tested on QEMU x86_64

---
Sanjay Chitroda (9):
      iio: orientation: hid-sensor-rotation: Fix race between callback registration and device exposure
      iio: orientation: hid-sensor-incl-3d: Fix race between callback registration and device exposure
      iio: gyro: hid-sensor-gyro-3d: Fix race between callback registration and device exposure
      iio: pressure: hid-sensor-press: Fix race between callback registration and device exposure
      iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
      iio: light: hid-sensor-prox: Fix race between callback registration and device exposure
      iio: light: hid-sensor-als: Fix race between callback registration and device exposure
      iio: magnetometer: hid-sensor-magn-3d: Fix race between callback registration and device exposure
      iio: accel: hid-sensor-accel-3d: Fix race between callback registration and device exposure

 drivers/iio/accel/hid-sensor-accel-3d.c          | 20 ++++++++++----------
 drivers/iio/gyro/hid-sensor-gyro-3d.c            | 20 ++++++++++----------
 drivers/iio/light/hid-sensor-als.c               | 20 ++++++++++----------
 drivers/iio/light/hid-sensor-prox.c              | 20 ++++++++++----------
 drivers/iio/magnetometer/hid-sensor-magn-3d.c    | 20 ++++++++++----------
 drivers/iio/orientation/hid-sensor-incl-3d.c     | 20 ++++++++++----------
 drivers/iio/orientation/hid-sensor-rotation.c    | 20 ++++++++++----------
 drivers/iio/pressure/hid-sensor-press.c          | 20 ++++++++++----------
 drivers/iio/temperature/hid-sensor-temperature.c |  3 ++-
 9 files changed, 82 insertions(+), 81 deletions(-)
---
base-commit: ae696dfa47c30016cd429b9db5e70b259b8f509e
change-id: 20260605-5-june-hid-iio-race-fixes-f8b981f82b80

Best regards,
--  
Sanjay Chitroda <sanjayembeddedse@gmail.com>