From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13B2531355D for ; Sat, 6 Jun 2026 11:37:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745863; cv=none; b=oJaj06fYQYuXLQfFvuS29D1sIDJYdGcuWC3uCx09dYaRrsm3gjVw9Fiaj2Sl7DMU7KmTv+ijmW+kI/upWVr8kiEW7MjHpCMK6oKddz7VcjVeFu5vRFWQITUu3ohBOMcCF4kyBLWDKHyQmobhFCugfVaC1iZ/teBOzAPvPSos3mc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745863; c=relaxed/simple; bh=iFoixcaubAgWtOmNYa8MGEmxxGpRfN83yA18/55OJQc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ittueeWl0RN6+vuSNg9OPWNu8W0MCDzChiMpq/rZE03vLuw6E6+A0ow5oQRzi+J7EkaFlleUVXgRPF04xSCVLWc/x9T11j6f7bKPEIQZFORomBikPRfJwE4aBzly0ro45xUdMrs+zvZxpDOHBwuRdw766I0uqpSN17j51OkU2x4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PupG7zj+; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PupG7zj+" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-36bcbd7821fso1154696a91.2 for ; Sat, 06 Jun 2026 04:37:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745861; x=1781350661; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=UWLRt5Ufc5uZrv1CDuPUHEEt/aIkJjHgw4R+DItFMcI=; b=PupG7zj+hNk++e1Hn74iZvuqOf+rLKTQja42HZmAdXHQrgTcIcooQZqsUIccuYMUhG oKCMh/vLG/jjIw+sCxVMUfAS651qdY3rcFxQBz+7b/0Vc1yQ15YTt7Uu7BDtUVSvpfdB cfhmWeJYqiSPUx1cMqJXnKD3cilSTly0UbiO7tsARkryGMRWWOk2PqjNPACsXOZ4nO+0 0qGSZOMFHyDK5TSdEldDiFStDJ4ybZb5zp4Wd4JDpUgGT7JVRSaFp0KjRSiOgnY+KAMO o9gUVcntY26S02L4Qbp2Ko0NJuwttqPBsVSR7GoFIMix21tTUTRXbuDs+2C3G/RnCTEt UeKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745861; x=1781350661; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=UWLRt5Ufc5uZrv1CDuPUHEEt/aIkJjHgw4R+DItFMcI=; b=fS0zE/kfHMBnfE2to3QcSgPPgr/4J+AMMWgyBhyUBh863J+uHuDakZQO5XMrQRN2RD NYfvutsoLNc936X+irzU9TVac903Z6Bow20X0Lh7/Ou1DeEYr0bSUcbp5qq5nhJsIHzy kzYhihj/nIAP5LHGgH7owAr/dCtnBTM8gh9hWI9/F6MtpfsQUHW+/LmISVIOtifZHNHw S+Fhn6xiBKgXVv4YFad1sBwQd7Kt1UPnNAFft4ltKlc7B2ML8j/8Iv8x/G5pyrlfdjHB QN3ashtqjHqLustordj4bR3N58hwZLAXxlQwB6nYDhiQ35sojnt8gyYecqG/pv4fKaIz xWEw== X-Forwarded-Encrypted: i=1; AFNElJ8D3G1Voao6NxQiGwfEZ4JthlLPMs/rESMbS9DnFVJCj8JFPItwVqy9Pctt6YGWiiphTTcdIf7UqRjfeXE=@vger.kernel.org X-Gm-Message-State: AOJu0YxtOHYGMEUIpV9Hl6IflGGhffRbJrXcfgawbF6EDVV5nXQhrZhX J4pApTSRTYd1yIwMHfqX8MSwR9lK2NfURyE97jTGMD3fqfOBWal+1STI X-Gm-Gg: Acq92OE3bQkCWNgXWFpSXvMekJIVqzXAE2400EangReC+/u26nF0PFMC6ReMdoy31Qe 9gr1mqWAAeIFA3m4yXLTTpSsKKmlWtLSn4jMXJQB5POIFXSaTnqD+yrAX3QiLnTJxLzNj0KEeyc lGn/3MjpQFqkS/tyare7/IOv+DtK9z2dhR9NFTrSaGKmz9Fhvfti53xNS/BdvTB+jOuAlzWSh1X ODNs40qdfWN1+QhEqF14VtYYn4aT9qPMp1GR7jdwaX3PwI8du2x84oYlwzoj5ovYKc9kByctGe0 4vv5XtPAo1rlZdBmHCTcPzm+2NCEj1Dcbps367v47eeMLiF67EhvcAEYL0F54G++Y1VHut8xutz AOavMhEMwu1l6NPJIzC8kIscmPuLHcmswQMC7E+TZMOAXaqRy3fjU7EqL7rThCtoQTJxLXub2G1 lVQ4+wFlk8i+KLjzWSuAjMs2o0gxYOtND4oA/pJ95efTTajO+EHX0Kd9SQhLQ= X-Received: by 2002:a17:90b:580e:b0:369:932a:2b8a with SMTP id 98e67ed59e1d1-370ee643fd2mr9471017a91.1.1780745861135; Sat, 06 Jun 2026 04:37:41 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.37.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:37:40 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:10 +0530 Subject: [PATCH 1/9] iio: orientation: hid-sensor-rotation: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-1-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: fc18dddc0625 ("iio: hid-sensors: Added device rotation support") Signed-off-by: Sanjay Chitroda --- drivers/iio/orientation/hid-sensor-rotation.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/or= ientation/hid-sensor-rotation.c index 4a11e4555099..fd9beb93cefb 100644 --- a/drivers/iio/orientation/hid-sensor-rotation.c +++ b/drivers/iio/orientation/hid-sensor-rotation.c @@ -332,12 +332,6 @@ static int hid_dev_rot_probe(struct platform_device *p= dev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - rot_state->callbacks.send_event =3D dev_rot_proc_event; rot_state->callbacks.capture_sample =3D dev_rot_capture_sample; rot_state->callbacks.pdev =3D pdev; @@ -345,13 +339,19 @@ static int hid_dev_rot_probe(struct platform_device *= pdev) &rot_state->callbacks); if (ret) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return 0; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, hsdev->usage); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes); return ret; @@ -364,8 +364,8 @@ static void hid_dev_rot_remove(struct platform_device *= pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct dev_rot_state *rot_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, hsdev->usage); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, hsdev->usage); hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACAD5317163 for ; Sat, 6 Jun 2026 11:37:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745868; cv=none; b=PUrDSlFKE8QVwRwVSv0xa2qBmxhLzG4rBKxmoqncnObHHXjWwhA/4DQTBUjssran9jLSe2YvHs9WOL5cPx9F0vK6fynVTvvUY/GHqiRL8TTnz1GXz4yKRNAS9SjFaCuZvvqm+CrqWzE0C7UmsDH04jreu1a9JL4k/I2oXm6khCU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745868; c=relaxed/simple; bh=05LzNFyyP8p5aiiuzjn0puJUjvbiTBR1WRQ9rKJrAzU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=abTfjPzZBRa3b6OwU1fKEDOIUGHliQw84MJVFYrOn/h5NZOvSqDEpTX8cE6MiIxH1I+MAjyHdYjDWc4dOWNuRR1dIdCk+6MZPjtEUj/9O4ah5x2EkcNltsk3H5Mg3tWrKMjpxKh1XjcL4MKvH8fqqJ63LcAtDszYrGDrToFuQMg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pi3olPRP; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pi3olPRP" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-36d5fd50d20so1812064a91.1 for ; Sat, 06 Jun 2026 04:37:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745866; x=1781350666; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=I7+XBukPZOD6mxxMvngzsGFIjLoIFkv28Pwa06nTfZc=; b=Pi3olPRPPCbT/ktl663qvjbUegZQnnib2TzJU52XIL2tMh9PVi2K73Bl/FyYD1Wbr+ RA/WRsXvnVOdFX0z+2fBmXh9njrKG4xBLAcfmXU/M7F7uvRFTJWjzQHRolc0A1ZhgSXd OYsxQVFp2pOZ2O+OQUyD6q9vH0MQPSOSS6Z6mOQGtZDGNlt27ebgAq1QSX3gnZ9Iq+mF bjuwoI9CDIiDFuTxBAsruB5QeJfzkhEO8ZU1LlTnsUC9b2PsA3zkmaFyNPvVUnirwRom 99Zp8t49x8SHuvRwLRw3mrj4fMn0o851g3oDSI/gtaYnyu/q++IaGSu6yhdqmvcr4naC Lw1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745866; x=1781350666; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=I7+XBukPZOD6mxxMvngzsGFIjLoIFkv28Pwa06nTfZc=; b=k3qfV8DfZg4hvQcg/rariNXWbTwUwH31eln8jrNtHEUEQ2QE37BmKQN4KPoWVxaz0z UQqJ83Vt7KQwStKSqThhhwglFqtwEo17YSQa46KUnFcqTXOk85HCoBa2WO3JYZBaV3fp 5fIVC+5RCg338vSZI0uugiyuSS9gOk2NDfZMDjR8/xBL0hOrw5bO2WOlHTKWbCtZxfTX E1jxrbQXPSA5qNfEKW8sJp2m16nqPqFtz9M8xXS/Y0ihJPOC3VTqxlA0BSrq2lgNj/aq +9wOfRp1pGolhjJ54MfSJmiP/OMIovptBxhEazciPOyGQInItvxi2ZPHULDyllp2kSJx U5Og== X-Forwarded-Encrypted: i=1; AFNElJ+bxcGP7KmlgGvuiXt4lK5lxLjYHT5Ju86fsypsymKmfgyGsaylqjAJUHszKD61ThFg1wHGwDWI6rvSrIM=@vger.kernel.org X-Gm-Message-State: AOJu0Yxll2PVM4vXJpe04DrNaaD7aVjQvo5Ry3MMhAh4ZH+pYEDI7Uvc zzAuv3C34m19gZhZKs051MqS/xZ+cHWU3lbRvYJ/Q9EF9aV4mP9DbnVC X-Gm-Gg: Acq92OGpVI7sHeQHT1Fmw3ut55k5U+vOh3UvFPWoxKksRJ6lKArick/XXVPAurf6Zty nHHeoO158gAsOlqF3iczL5FHWe0zPSGSX1C6Kc8dLts3LEfD5NTRW8n23DEkHlkIPxkmgV/CVVE qJV0NWASbLP4VYpJ5nw+xHwUOJzWR3D3dO1pCNuD9sWg1fiqIpDz54G6Y2zyKL5PAzpKkdll9CU VrCL4IDxysOHggMaasXOGHzffxciMz5SiT2TZ/1Lr1MOivlqpKKCY5Cvzq4lAD9ohK+0pQ3hg1A x6KkEHZBA1bsz7emVQAakRQ2QIMOFBlNni8bkPhdd1k4MuYKknmD54rVqU8rScSJ4PqipoTb/zU pqR+0chvSC+bgX6ZcsOV8MG3jMRnyUNC5SzI5ZmozDyJ0e7MGxROdUko/xwzizLSUPROqaf9+pB 6BjdKJdhp3EmA9lh0P4VboGH2xneq9PhTINCstTZ3+PkT+qmhPy5ysjEi92wU= X-Received: by 2002:a17:90b:58e7:b0:36b:936e:73c8 with SMTP id 98e67ed59e1d1-370f0e4ad33mr9461694a91.19.1780745865902; Sat, 06 Jun 2026 04:37:45 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.37.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:37:45 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:11 +0530 Subject: [PATCH 2/9] iio: orientation: hid-sensor-incl-3d: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-2-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: 098d3beccfb6 ("iio: hid-sensors: Added Inclinometer 3D") Signed-off-by: Sanjay Chitroda --- drivers/iio/orientation/hid-sensor-incl-3d.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/ori= entation/hid-sensor-incl-3d.c index 4e23a598a3fb..5e3d2bb9b5bf 100644 --- a/drivers/iio/orientation/hid-sensor-incl-3d.c +++ b/drivers/iio/orientation/hid-sensor-incl-3d.c @@ -356,12 +356,6 @@ static int hid_incl_3d_probe(struct platform_device *p= dev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - incl_state->callbacks.send_event =3D incl_3d_proc_event; incl_state->callbacks.capture_sample =3D incl_3d_capture_sample; incl_state->callbacks.pdev =3D pdev; @@ -370,13 +364,19 @@ static int hid_incl_3d_probe(struct platform_device *= pdev) &incl_state->callbacks); if (ret) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return 0; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_INCLINOMETER_3D); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &incl_state->common_attributes); return ret; @@ -389,8 +389,8 @@ static void hid_incl_3d_remove(struct platform_device *= pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct incl_3d_state *incl_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_INCLINOMETER_3D); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_INCLINOMETER_3D); hid_sensor_remove_trigger(indio_dev, &incl_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62E9739182D for ; Sat, 6 Jun 2026 11:37:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745873; cv=none; b=OsZX69oP52pnMiI9nJAwl0ouyzkr6oSl37vFjSjyrepqO/do9BKxgLZcRqvhfUFrC8Q0aN9NGkx01i/wIQ70rfkGkU6NhXSkqRFvtYJHQxQtOiF1NkQFVv91LViq+37wxnHQKeerE2TIZWYvpmMwgABl35WMDR30acr+KGBuX9o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745873; c=relaxed/simple; bh=my9JUb4j4ckhQe1O2hmlbhJt0m5r6DxQlwll6XTdQyI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=A91ZOV7InGlH+0zpogJh9SQ7wXzUOzbib0clrDj0fqGWydhtZX5hrpSP9jkQVfSlK2NOo3AmFChFiFyQG+sTCuhG78FM0I2syNWIM1Tog7lKI9dZWkTZnJcjL1j0I/7L/CySklvyORwrBszETVzmbpIGPVnueSdJ00R6FNvWHWA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=n6EwfgZW; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="n6EwfgZW" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36b95eb4bb4so1875356a91.3 for ; Sat, 06 Jun 2026 04:37:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745871; x=1781350671; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=ZktAPPM4OmMppmHHDPMiZ/93DsCQO+a+WYAMVPBpJp8=; b=n6EwfgZWffuaq4Epr3ow067l4o42klc+gjYo1zTi/+3jTiLJNkSPI0RgZz89tk6ALk ShgyoBdRpChOk5VQUt9yhHfQfpc8VBtpsX2e15WjRlYVcZj3mOf4lsrNfdNJTSQLftrR c21+WieboudGk0KPiK33btXr2z0knQ2bvIEg/JizifzdMPsx4BDVSy4tZ+oMW6YXH1f4 dXOoZJSbTaw9q9gZayY+qNviUNVZGTqmWJmRjrwxfM9nKU6b3r4VJECmXW/eoZnh0vL6 uURjr6OHftJsdby1woghqq/zCOGJp8zgHdT2ekS2J15bwITrkG1WBbc00x56UEBkFg7C ixnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745871; x=1781350671; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=ZktAPPM4OmMppmHHDPMiZ/93DsCQO+a+WYAMVPBpJp8=; b=ZhuK8X8+XzPALxaTlzi98/cDq59yVQtRCnXFd7a0VPh+EreY0JzfHb7vMYx3qQxpHL TtE7X1TsdYBuR0xfjRrfTtkssdzpFj4xUn/OInWGTyTodjCL0J1O9un1j3iMJPXJA8// T3A5rYBtqaAEz/HwigOzGcOo+Tgv4snLjTze8U/ib4Ht9zH+erQWwoGiTgJ4eU7ubHeF 4hQEhkpHy71Q2xNLfc2mgWNysIfHnu6T1oW3Of05+veA2ihdMID8tXOb0MMyqB6GHP/M R8X7YI2ngGRF6yrwMFJS1QqAP/g0Q/NyxE3zP3eMnIy44QgDXx9HvdxEOrN3mjEyHAG7 fnng== X-Forwarded-Encrypted: i=1; AFNElJ/kG2tS/PHdDCePM9wmq3jF9dlN+MOF9T+PJIzH9JPiNVxZm6Wyvrb5Ke0EWbWAeNIZPrazTUsBUUnV/BU=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+iVx3n8SGR2niugdK/JbOUmdecN4UsOSLVCaT+005gPFNaG+V GydGwOUicwTcYfYDaweTErITKBb/Zldy7nzRnQRZ+H2L40I+L0ms2NyV X-Gm-Gg: Acq92OF2D5XkGc3jmcS5R1h12bh9KmzNi1pwGomW+jjUI4N9h2ckHOYvUW/kfMBRhli nzsyEwrZRvwF6iMzyxlAxnFIWyE78Scp1wONu+l1+8G2gpLsz4vG/7rPMcgTjF/ODEr68w/JlpO XKxH6hFc7xBqTQ6jdaEUK/8jBQgRNQMEitardFnh4ejNlFMmnbYYpC1dXxNxG+UeYNZZoO5rbc9 Itr/UuUylH+RcMVP0QELQxwQJaQabM8BHAH2qIG5IBk3N87MhrDAXaMBzqSQFhf2+5x33frzudu iTLYvSZHNlX7shTsMS7h+H9hyV3C93ZKYh0tzBZB14wTS5jtJCR05lp+DlzOrvjngGole5NXUrg +QYFGb85jKTsjV6cfQR7OqUH8hrFLOPARskBmeEXS9DAKudaX91+67EUPR8951QIicyb4cAl+gV P25du9ysrVT+gl3AB7faFTpKw7kXtpthaAR/Q2MopX0vRlFBS8c+OXviJltAQG9o5Hyy0U1g== X-Received: by 2002:a17:90b:2810:b0:366:2e1f:393 with SMTP id 98e67ed59e1d1-370f038831dmr8408816a91.21.1780745870615; Sat, 06 Jun 2026 04:37:50 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.37.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:37:50 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:12 +0530 Subject: [PATCH 3/9] iio: gyro: hid-sensor-gyro-3d: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-3-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: c5bdbef704ba ("iio: hid-sensors: Added Gyroscope 3D") Signed-off-by: Sanjay Chitroda --- drivers/iio/gyro/hid-sensor-gyro-3d.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-s= ensor-gyro-3d.c index e48c25c87b6d..dd871eacdaf4 100644 --- a/drivers/iio/gyro/hid-sensor-gyro-3d.c +++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c @@ -324,12 +324,6 @@ static int hid_gyro_3d_probe(struct platform_device *p= dev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - gyro_state->callbacks.send_event =3D gyro_3d_proc_event; gyro_state->callbacks.capture_sample =3D gyro_3d_capture_sample; gyro_state->callbacks.pdev =3D pdev; @@ -337,13 +331,19 @@ static int hid_gyro_3d_probe(struct platform_device *= pdev) &gyro_state->callbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes); return ret; @@ -356,8 +356,8 @@ static void hid_gyro_3d_remove(struct platform_device *= pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct gyro_3d_state *gyro_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D); hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04908391E5F for ; Sat, 6 Jun 2026 11:37:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745877; cv=none; b=pjEdtPpR11SRwHYUDvRnjpMcXVkd9iOU8gkiSNp6fyFfnjuLBubArydez3n+5ic24WcUauxIPpUt6CkLt4oYo5jcUYZ9szlYMkXrW34/cFVtk7MpD6RCqaOC3sKKaO2wHj5+TlIjZH0GMG4/27dLUkI8Dc68WtIFstL1HLp3rzk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745877; c=relaxed/simple; bh=IxWtMSSkG0uT8kHr8d5CirqJrItHTinUyyfdBs3LVrs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=cxR/lfUN0QFinhP9UnU2DEWjoagW3X+ASMSXVL5Cpz5kToMgo+dbk3rnwBUvuoVYDgywc0ULWZP9LaXxG19p9dhCSybUXLFsmUz40xudr5r+YyFZCdKmwRpwljSXNtSwEsh0iKOEH6R2jRYpclZkCXHpSAmIWcRkRlDd5iLUKEM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UuVAmD1a; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UuVAmD1a" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36b9d265355so1574095a91.2 for ; Sat, 06 Jun 2026 04:37:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745875; x=1781350675; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=HXKkPy5oWLhHBJkcovnBZBOpEfG4u+8zoMOu1q8eWRE=; b=UuVAmD1aSqxryLdDAb0S6jfoHPekOnDYjRzT3rE1lyXNYcl5J8tGf+JhVnI3P3BYi9 WhEWUb4vqo1/OyIyWAgBcDggivYdz7XlyqOiXiKEYHxRdnfMjs5b4+oYpG59TNnvz0DF 6/9QzDmept2mR3czvw6MpyZXU5c407GGQ++jvKtMGXIoX1+PxobQJma++pV3r/8YnHzT VBatl0z8gFmck3pfn99DckdkvW4B7PJYF+GgSEz4q892JJZEDNag7OffBUBQENHqTSMg yUYrAwDqScvRy+QmWOyGUuwdb3262C1BjX5ZQYmMKT6f/os/Pi2VB8lzQaOxbbDCBUHK uWTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745875; x=1781350675; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=HXKkPy5oWLhHBJkcovnBZBOpEfG4u+8zoMOu1q8eWRE=; b=P+7rN9giWersRPCzRs2u32CfVi4XudvyYdnS4FGBkxjHGMDSR7jWV7G9pXslcuSSVi XdGSf5V5cOP4CokIP0WVHZsBgUzjVrRtizNki/wDs89JSDb3aA2vhBZ3wIpcMQMANrku tabN/7+qL3+2ZLen9i49BkXczaOTIjmsMSJYJTR7ZxJGKrd0iKHttiMzf1GOmLP0MyRF 5B6wMJxC7LOBeOvvQMWJOhBBP6BfGQeW1uKBbrELVGK9yRNkMhgXWD/Vd3xdfdAuBSBT TCju4YJo6ZS7UB7OxB5PG2E56FOIZIUGU7JwQiRAJF+0RziYfyhpSwbHoxr1zEZbumsl R7TQ== X-Forwarded-Encrypted: i=1; AFNElJ/uJ4jx/Z8L4HXTgh9fbfdoDTZxnwjSWd80lWrSistsSiS4sCMwyjK1NscmyiOl4wH/9ml3oLM/siv+ozI=@vger.kernel.org X-Gm-Message-State: AOJu0YzRweELzw0G0zMJZSUpn5grL80ll/p1TURD+5CAwHqQCNhF6Wil mxwsjLDd3qmm/MXXxMyxg9G5xA/ie74YWb3BtOJdsIEGrxVfSZ0ilDyy X-Gm-Gg: Acq92OECGvjdwVAOysQTuQUzuTQi7JsCP1nHY5iS6LapjH66qNIllE9KxM9k+5zoqfD 0KxwUjsVVtRQln4F52orSAu4tOngg4jA6+iq1i5eWwIhlhCYOvZ8Cb5YjOcckuyQ+rtKtWTAcnx KNG9HsLVFY2F/2VeefwPQj/zLT7BZWpm0Sv/g+ZmCkrteHRTskW9E2vN0o+OmzHqzJ3sEtZSO+v YA20naFTdM65Dp2pz+iF5mnjA9isjCK5B1WIastQO2jC5YPEXwsruRrZ+r/SvZ4Sz56JEazNlWI LtcYAAi/xCHc2CgQgzrMKJtlV3Zb3rcsIRcg5+gUFye3pUQyOy930u4X5dDlUMqdEIBLBGAFpjm EaY+nyqRJcNLPYCyaUH9w+eljQUKFXubaHDnJZQcZq/mqm126BOAdH2NY5CMJCOK9Ngd4n+Wfr1 rkozmsMNcjs5kg+2XCmaZQ5hzNuJUvodMd5hI8mnqJqEHgAc8NHTOqH3mVnL0= X-Received: by 2002:a17:90b:53cf:b0:36d:b818:f848 with SMTP id 98e67ed59e1d1-370ee82fa47mr8855216a91.5.1780745875380; Sat, 06 Jun 2026 04:37:55 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.37.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:37:54 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:13 +0530 Subject: [PATCH 4/9] iio: pressure: hid-sensor-press: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-4-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: f64a799b8a49 ("iio: hid-sensors: Added Pressure Sensor driver") Signed-off-by: Sanjay Chitroda --- drivers/iio/pressure/hid-sensor-press.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure= /hid-sensor-press.c index a039b99d9851..09795473948a 100644 --- a/drivers/iio/pressure/hid-sensor-press.c +++ b/drivers/iio/pressure/hid-sensor-press.c @@ -291,12 +291,6 @@ static int hid_press_probe(struct platform_device *pde= v) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - press_state->callbacks.send_event =3D press_proc_event; press_state->callbacks.capture_sample =3D press_capture_sample; press_state->callbacks.pdev =3D pdev; @@ -304,13 +298,19 @@ static int hid_press_probe(struct platform_device *pd= ev) &press_state->callbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_PRESSURE); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &press_state->common_attributes); return ret; @@ -323,8 +323,8 @@ static void hid_press_remove(struct platform_device *pd= ev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct press_state *press_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_PRESSURE); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_PRESSURE); hid_sensor_remove_trigger(indio_dev, &press_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 066A6391E5F for ; Sat, 6 Jun 2026 11:38:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745882; cv=none; b=YwDL8NQN9nFXQek03fM14M3N6NZaXnAm2WteLrii72FaCW+3HOYx8oYLePf5H7yKXZkAeWITQf3YQx87KKQrG7/GztvkhyDig+gGy/9CR9RbXlgK9bYLaNNA9fHP6bP0WIBboTN4k8C7AL4s/CSUZu7X00cd9ONMW9SZIRjL4K4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745882; c=relaxed/simple; bh=PdUKDn3SU2eJys++eOMc7I+5A6p9MCo6ZvhZceIqZWg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Ifdm1rK0XSHWyGyBsqWZUxYkDW49kmzqPgTdE1v6tFMQoccJjxTH+C3sF+ASofT9YVEfZ6SFxOt8vAjJPp1to617QQXLVXVPqXnGKKnDUANrNNwB+cf2dif2SbFEekeubXNjKTrOsLb7B8h5Lpv7TYyBQnOouW7ouZHDOuxFGd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VqjJR3/j; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VqjJR3/j" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-36ab8816a35so1591040a91.1 for ; Sat, 06 Jun 2026 04:38:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745880; x=1781350680; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=HWSBV5t7vgvzy5zfpTiogfYypqNTbSS/3Dq6vr9fHyg=; b=VqjJR3/j2Tfrd6YUdIrUSHIG5wkOORUZYKJQUlj4mEYiiHx9O0SJ/J1dRGnlJpTbw7 VWcIUipedQFTp8znqFIXGXgw6GlB8BGcCymZyvEW5g4m6UpPrs6PD5pEI3D/y+nsDpyv Rzt1EzOtf7JDBxUyRHkJOvwnS2jbsv2ZHW8QywFqfqlemvEoqacgt9gSDS8zALr0UNIv ozHNu+eI8Qd3HVgDrhgwiT7tLXHelwqB6BSj/+1ZKXE4SUU29sKfNe1Lu1yioMTDNeFd XJozQ2ooSsSoT64nJPVFXPr6tuRBwDopBFDFBY4P/XatrCgbiXMuadCf6uqdZg/Diyrj kYfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745880; x=1781350680; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=HWSBV5t7vgvzy5zfpTiogfYypqNTbSS/3Dq6vr9fHyg=; b=Q2XeyrV9jn0HeX/uGzip3xS82JpTuxnwc5nha9yKI23xD4GnXYeGqxXY7Esa5qpCOI KQZQaJYBDREDLLqNEyZzgxtwiJdQxh4iIUpLH7IDh3ezJ4+VL0jIKzqjhLUiloDkX00C Nf3eV2tYqiTpDC6IJLE8lOkEXNUu7lOdJmz6yGUOUmW03pbMSX+hsaDIYMI0UdE9i/8L S5dyKsz+kh6YGBx8gWv1gnKyzyvqOqywwRIQrXYTnrRebCyJwv0vnO7aHPUfjTp+92zw dK8ogptU7UZpAkRbaIeG7jPXMO/LwIGRWP0U2EJXVf5/qoZJp5ICNDcmPAOS7J/Cdo/O VseA== X-Forwarded-Encrypted: i=1; AFNElJ8RPq55eVYzUum36pHeTljXPynlLJ0+rMzj0a5aqoiUgphO/6kWR8SREZD9MQRUC2+2bI3tB9wWtwbPCzw=@vger.kernel.org X-Gm-Message-State: AOJu0YwSMeReOg0KTfFxgTju2UVLJenEXzsnpfH6XxEa3UJjndzW+LgQ u7N9JNZIneXxoSFwBxwKcDlsufxKUypRIufcjZZP7ei8vStg6LBRacFm X-Gm-Gg: Acq92OHv9EUvaA6E8AT6orSLxom6ycPEbFOn0ZDIn16US9zl4Kzxb2DFJ3WX4p7qxki H9UWCsP9nvN0ZEDD+1KxptNFXBmhLq3X+A+9kD5BN3/SdeO/qquRp26t8q2XmExXzevFMuRiHDV 9plpNZiIkR1Ou8xql5JKnvYg5kTyApqvzEFxrrsOqzTqv2nSy0zA6OltQRT4vicVE/aXRFL3eyW t46shzXnD0RmnNck+ZLhDHTvfQTbP7cdq56jXuhOZ5+CwubvFUAbQdbQ0CBw7mIQ32UXUpS/S5i ygK4nOsHod8+p02nH3Pfq4Jsw0VzYQlx4CKJIVutRPH+D4CfRHrhnTxMHjzO1cIiv+ePg7pKgMh DaKTHvGJ5sGbtUjZq+K3VMhSgEdMgCwg3lwZRZQgbhG4BwdmN3i0i3WqYlftV0s3vii+Vwgk8r4 vOJMnk+gk1pm1NpaXRU0Cm5VkIymBKNLAr2TKVnFwofy3Akkfvym0DBbOlpMI= X-Received: by 2002:a17:90b:380a:b0:36b:b06c:30a1 with SMTP id 98e67ed59e1d1-370ee447ddemr8402142a91.1.1780745880167; Sat, 06 Jun 2026 04:38:00 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.37.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:37:59 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:14 +0530 Subject: [PATCH 5/9] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-5-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda Avoid using devm_iio_device_register() as this driver requires explicit error handling paths. Mixing devm_* APIs with goto-based unwinding breaks the expected LIFO resource release model and may introduce race windows during teardown, potentially leading to use-after-free issues. Add explicit iio_device_unregister() call in the teardown path to ensure deterministic cleanup and follow kernel resource management conventions. Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support") Signed-off-by: Sanjay Chitroda --- drivers/iio/temperature/hid-sensor-temperature.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio= /temperature/hid-sensor-temperature.c index 9f628a8e5cfb..34bff7e9f3a3 100644 --- a/drivers/iio/temperature/hid-sensor-temperature.c +++ b/drivers/iio/temperature/hid-sensor-temperature.c @@ -244,7 +244,7 @@ static int hid_temperature_probe(struct platform_device= *pdev) if (ret) goto error_remove_trigger; =20 - ret =3D devm_iio_device_register(indio_dev->dev.parent, indio_dev); + ret =3D iio_device_register(indio_dev); if (ret) goto error_remove_callback; =20 @@ -264,6 +264,7 @@ static void hid_temperature_remove(struct platform_devi= ce *pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct temperature_state *temp_st =3D iio_priv(indio_dev); =20 + iio_device_unregister(indio_dev); sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE); hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes); } --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A761E392C2F for ; Sat, 6 Jun 2026 11:38:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745886; cv=none; b=umLW6AapcsMpBsShYpvEwT+qELkwReWmaAzcidWFDTRsShWrZQJPBkhcRjU6dmiqF+EMktWgtdA5o+kbdtLiMp7rr9cesgTlpCh+pwfxxSVOGV/W+zidcyr6joKnDZrTQjwLpAoKrTP6Md/YMlHZv5FYw5oEvy2cFlno85o6fWQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745886; c=relaxed/simple; bh=IkWYpyaCbZKJ8ituXTGqG8rSXM7Oed0FmrF0L/Ijgbs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZmUQzgxrMRqIP0s8FzDGf2rD6I1r0JLd9RMluzVol8WhXPJscu3dY+BhxFB4dtIVBCigLzRNXg4/og5Am6GxSMbEqdqboC7TgdlcCKRlFFAgzBWyNFA+VYRMEqYjq84xXxUCb0gk3IirNPu2nHBOloOKyLTw+8VlLHDZbv1q/f8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fOUxh4va; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fOUxh4va" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-372b4330deeso17309a91.0 for ; Sat, 06 Jun 2026 04:38:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745885; x=1781350685; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=x4M28aP4OxLMO+MfHO2nNoeotU1DoAdjAzATXUUow/k=; b=fOUxh4vaRvea0upDM2Tg+bqtSY6QqJQg7sBBmXOIEkL4ykI6HjEybyaisHb3OnaRhX /sY2LS3Yzk1WX5edKlzdRRclACPJCTelTSmIW8Z0vCijP/tKvZfQxcqRo1xSz5qWjGwj 5eV3oyAneP/KMz//I47U20uQmi/p5UbtEIIeQq8mnTwce0xh9pAIJKMq7YaMdAseSS/O qvNgBLtfZ1RjxcYKiCP+doNqkHSJbTa4FHaxvDSuegjiMLAZAaAGMh4euliXnAOOE0Rg LjQRAiYNaQPEAFGM4MnEFJdAtQviU5PhCsg5jX/rD5ZGd3WFJ/G9uOC8oGY6TqSNGFPB ccww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745885; x=1781350685; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=x4M28aP4OxLMO+MfHO2nNoeotU1DoAdjAzATXUUow/k=; b=M1NdDAZ33haEaMapbIhkFxhDWFAVKjtZQSJ+JjPtyKmrICq5OaqCFlj5yMfazJGcac NtFQC4dKlEkxSTs06VpQCIkJGleqKxkgpnt0CZ7RD+lvukQEissdMnskiGRkqDeiPBLW e9ZpvejahmOz1ebY3hqB4iOf/DwO3aKU6meWIn6B7a7DENW1Cv9+oY+/rU3Oid0raJvf u7Dahj/5GRnqWNZp4gBpgWCeZOI4+DLf69oySLpHL41crGGipVn9uVC1aLy6YSW7PZ0k 7/BLVy6sZyGj9FtA9MwYcmSaYfPpBjEMdSPKUGF+C7L4XNRIXVojRqFlUdEEovAL6m6T t1Sg== X-Forwarded-Encrypted: i=1; AFNElJ+upgXe7h4MsM3dCEUURkp6g7N5FjSnI7p8UIrXq0JANiBDjMzjULyRzjXjZJkX0BchUoDL1Qv7E3XD610=@vger.kernel.org X-Gm-Message-State: AOJu0YxV5BJEy9f00AbbusIzmqSgYpC0PtZdK6QxaJU+ZMxxaUPmuhdn xCLSoY3u1UWKWnaJfeSaPXmoL/4YQeA4K6ComZQ6DVPGzbSgUdVXDxd0 X-Gm-Gg: Acq92OEmFOSuFzvB5mrckTx/TpLWozpFHMS2BsSi4+ptkzQ2vM9VKwNvzKZRstKrOYb dsD2AJ6M+qXgrHAUi6/S1OQas7TKXVKnfk0MtiVTXFg7D3098OCNxiTUa/pGBc/j+2gOD2FhNHl 0UxwiBt0hdNTO+AsGf5vDS2mrI3GmnBOydOYCsXCOZ8Eu6yQno3OObJP5Pwz7g1Mi2KZKn0vTbw qYlgmHNRvNFoMjCrsH06EGvgj7BEmOTkI4OLBzfRq1h5SJrTM4mGK0B9doRRItAhniflx2P0nTu aj4LE0tO9q9+fuSrXMdnJdXyIoXG5m9izNEKxrnFECjp/Q0FcZHa+MiBDvcpCwj9FmsqBBTcddA oV8C0oLH2Redq69Mrogl7fucuCzbJJsDXkBhW7sc3/GWdiM//GCtRIirTjBKaei8ekHGbxGE6U/ IFHql+L5rmRq7bqO7pf3gjlpLB3g7lMk6Syfw0FRdLcITUa3RDPi0NUOxQuLY= X-Received: by 2002:a17:90b:4fd0:b0:36d:66d4:270e with SMTP id 98e67ed59e1d1-370ee5450e3mr9765084a91.5.1780745884886; Sat, 06 Jun 2026 04:38:04 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.38.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:38:04 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:15 +0530 Subject: [PATCH 6/9] iio: light: hid-sensor-prox: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-6-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: 39a3a0138f61 ("iio: hid-sensors: Added Proximity Sensor Driver") Signed-off-by: Sanjay Chitroda --- drivers/iio/light/hid-sensor-prox.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-se= nsor-prox.c index edc9274a2c07..3df7f28d3b44 100644 --- a/drivers/iio/light/hid-sensor-prox.c +++ b/drivers/iio/light/hid-sensor-prox.c @@ -312,12 +312,6 @@ static int hid_prox_probe(struct platform_device *pdev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - prox_state->callbacks.send_event =3D prox_proc_event; prox_state->callbacks.capture_sample =3D prox_capture_sample; prox_state->callbacks.pdev =3D pdev; @@ -325,13 +319,19 @@ static int hid_prox_probe(struct platform_device *pde= v) &prox_state->callbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, hsdev->usage); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &prox_state->common_attributes); return ret; @@ -344,8 +344,8 @@ static void hid_prox_remove(struct platform_device *pde= v) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct prox_state *prox_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, hsdev->usage); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, hsdev->usage); hid_sensor_remove_trigger(indio_dev, &prox_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A135391E5F for ; Sat, 6 Jun 2026 11:38:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745891; cv=none; b=nCyDPRLzOBA3wauPvFAUfDhEhnJKg5xGfNWckJTzNKl7Rabi3Jat//nuQo5zIckVtU6q2GJ2EZ9kERcSr6Cvg0Yf9OMKtaCHGmdm1+euQJWz+Nl7cK66dz4/fe0BZaIBhFr+S3cojEXFX+d7xyBOPCabffZ7/hV0lvm1fVQnI98= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745891; c=relaxed/simple; bh=YdwH8OoKSk44T5rJd3P/7+DNbTCSOxu8TkOwBfLzI0A=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Qz1pZmGTz7Ixv22GHSwVaMQMV6ZIFA68O5V2SBYzZ8nt7/wsVlaWi6QhrdKw5GwHIIjp7gtxmYl8S/5r8KATaI0DJQdo5xV/mgAS/UqaoZkVgDHaTwBP3Z/GuO/Oic6Ui9oXhKAV25iMXu7tIGLlEis9K+xVpx5pxnxv6ECnrB0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=L7X+Edf0; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="L7X+Edf0" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-372b4330deeso17346a91.0 for ; Sat, 06 Jun 2026 04:38:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745890; x=1781350690; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=fhNwJ+gs7E9ihqXUs2Y3jA0VKn3cDSzTwU3DSDgrU6I=; b=L7X+Edf0/zRCy97vV0EugYAZ4OpNAiLT4DoiVjahD8nmovrJ4vcKS9hcylzvotH/7q JCW2QCOvpyLahW76tajZaVYpKlZEppv9PlrIYGudPiHcrdX/ONA43xw76AW7dPzmfCby kvsRjYa384eAX6oHp2qfkud6VieVH35bL25Szu3njG/0KPeSaGP+cXDOOkRmv+eU7gxV tvF5oduZ7XAcTr9NdZFROXF1lNz0k79uCH4nOFGc4QGlXrQh0Sx6Aojxac8SrjTY+5EC 8vNFNpJtXJB6Du+Yv5vlOV2qTWeUkmBLnLg+oxgvU9z93SfxvSXinVaUPHX6XpNpXas3 +8+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745890; x=1781350690; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=fhNwJ+gs7E9ihqXUs2Y3jA0VKn3cDSzTwU3DSDgrU6I=; b=E90RiRaqVFcWpvFF6+k3kXj58WLu6FYzxqW62CbMWH62PL2I064KVstKgsYyBDZgCm Zn+L6BWy+fdvFNH1jYHFoDaJQuYhKLADDzkXA6IFM02EKZ+kOXVrxSFa1obvPy36NFdM l0YBrI5j8F9cqz8/x3cFb0EAibB1g3Js+1vuxoItGWqHfzfpuuRCZ0zwzk5JPT2HkeGW eyaYZKZC/bPBImaSH4Xb6zQs98rMXXU0CSfiRbLF5VodlAo90oCTp+el/M0UbHPwr5sA hrJJlEbkGZ6CQQrDgKcKLPQl0UrCkLyIBjETAewNsgZRg9qw770ZkEeW20Odyfr/HvBh Blzw== X-Forwarded-Encrypted: i=1; AFNElJ8RMtaxTw6cNv+6uznkvDdPzO0Db0j6970CIs9I0k9LG1ybDgb41d099vo0b6KPLWISOcctMNzNMHtNETI=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5viL/XrAyYXzeqSwOeLDd2MGwEtHtnQal4AT7XbhZ4UHm82hX t7VJiwtV0YsmeDjVP6V3HCIZCn77rNQoq6R2QcyUdbtmoKoHwN1HJXvy X-Gm-Gg: Acq92OFobvQSwZ5UByRpslpJAqWWoslV7LUymBTwN1//0DTi3QJ+T+exICbnnspw5J/ 48llMJnsSUDDqwh+8E14RLGORBN1WiPNiT9zVvzqNFpRhu224HH2If/hOJawtiK4xkr0X+PkMvw w7o3+WB5loqUeNYs/fVUVkp5+BwjVxK54oyrQidqgsFZ1BfOXpJDhayt05kB48lPFNJnrBUAic5 mruStKFXd75Rm3CcF9OEU7DJP828CLFZHeZsTeUiDzwzUlnHT2WPG5m2s286T6y5ZMsWzosnF95 c461LoMeeipFKP4+ttWGqzwq7gg4bDCAVObjn9ZusVIgRobwgGSiIkTCc0iS0U1lKi0NutF37C1 H2cwlWho2QMvhWW1FSWFQmCVs50CNgXZrci1q2Oz8dFWedPiJ30ytzjxCNAtjqKPoJhm6FZ7awT Nv5U78git2kxb1OaRASKa1Ew+oKXp1HQBjxJTukqBmNXUABKBbwDeMstOGLOE= X-Received: by 2002:a17:90b:350e:b0:36d:79c6:1562 with SMTP id 98e67ed59e1d1-370f14305fcmr9575910a91.25.1780745889652; Sat, 06 Jun 2026 04:38:09 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.38.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:38:09 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:16 +0530 Subject: [PATCH 7/9] iio: light: hid-sensor-als: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-7-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS") Signed-off-by: Sanjay Chitroda --- drivers/iio/light/hid-sensor-als.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sen= sor-als.c index d72e260b8266..93d603848690 100644 --- a/drivers/iio/light/hid-sensor-als.c +++ b/drivers/iio/light/hid-sensor-als.c @@ -406,25 +406,25 @@ static int hid_als_probe(struct platform_device *pdev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - als_state->callbacks.send_event =3D als_proc_event; als_state->callbacks.capture_sample =3D als_capture_sample; als_state->callbacks.pdev =3D pdev; ret =3D sensor_hub_register_callback(hsdev, hsdev->usage, &als_state->cal= lbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, hsdev->usage); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &als_state->common_attributes); return ret; @@ -437,8 +437,8 @@ static void hid_als_remove(struct platform_device *pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct als_state *als_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, hsdev->usage); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, hsdev->usage); hid_sensor_remove_trigger(indio_dev, &als_state->common_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 112DB392C2F for ; Sat, 6 Jun 2026 11:38:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745896; cv=none; b=G+7zCVlK9KoOqQRTwifpY0n1lF+AvLjEtbq4yjI/VoqE31SsX4I02EvLmYZOFbjLXeAg+sf2z2H8tsZMGeXdG4M5cIkwGPb1rAx3gEBM0gtgehXbtUtIHihXVESn+9bIWInnjmH2s/uuoqWcFVow/nqe7OqlCB7HW20BNLPriM4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745896; c=relaxed/simple; bh=ff0ydlbObc/H3M0SwnPzFnKsj50WYoQR9JEzihmmciE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZIDLrwFXMwDamllnc45wZc+ai+yp0tQCGQkIOIidz2H9GAU+8wY5zpOJSm3nVzno0OpcDqGMIUFEov+ARrnwnSLMFyY0dmF81WuoSVNZYvMt47GxIrMF1w0ZWqq9Fuy/hfLvPqiZd8UM9NkTN9z2YVny5hxJDaZ+QyxqJUXB16E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XQxLh2iB; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XQxLh2iB" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-36c68964315so1425342a91.2 for ; Sat, 06 Jun 2026 04:38:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745894; x=1781350694; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=L/MHiUlYgig4GdSzSIIBUKvbsbnQklzRwQhWCjskiuk=; b=XQxLh2iBj7mPN4taL248dJzK7lM+4LKdshpMvjszx25yFCIF3h4t/CCuEmPgcF5M+v EQTG6KGbkJa41ykds2cWxDOgmWoZw5UJ1KtRG8DkrEirNS+snTRVofd6g1cViabr7yXv b3mwcbMH7IV6WT/avc/gXo/Ki3Bw8EDIBufp+9cq1zv8jk+Zq8uamMPPhuwQ9Ooae8Vf ulyFoklLIlmoS6szPuv70iTmVIpUVPzz2dSyDOxW+oLU0KLGV4xeJ5TlwCzH0wATFcI1 unHCsZvYTl1Y/eXNZvAZSocW/gO9nDNGotbSHRP+ThSyOwnEqr1Hql66iFcwfMLMdGNY I2Ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745894; x=1781350694; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=L/MHiUlYgig4GdSzSIIBUKvbsbnQklzRwQhWCjskiuk=; b=MkGZblfs2g+0ADnXXzqWAdQp31mNxprujhV8ruoX6SPhOu1nlK6dERlVMU7YdhSYHu YsUPRK3ssQc0SA2uV10VPWCysQu96NT+QjfzPF0AG44OB+CdFgw6CyBJ98Jftvskq51g 3eMFYXTis4vDv16bVG6GiNpPL7oR6vsbv8HexS+hQs+V4ro95Hfp6y0R6D8s9jiQg0dp ezqr0VWzbUk1l38m30eRQ8AA+J6qR9Vb4lCw32OFR1O0KcqD2m9ReIdqX2/G6NtRNA1K RtqqdYfoSqESO6hnMhzd/OvUvdmqzcITaWK78bL1YwN+ltJm1qaAhpK/36k/AdmnN2/w womQ== X-Forwarded-Encrypted: i=1; AFNElJ/dbmVEGiDOP66C4SVnno/YUwsj75hyASVIWM5AS8wphWj/PsweHnFcW2IfEXcYKK4Dn4zVeZjMH9JpyTk=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2NA0nL2RPO902hPv8ZmHEbNjSk4tOuGbFNQxHO1hhb2kKEqmg 8rXrDnD6JFxfR/PjH0m16Fpeztc446wHgIaKB0pAbLc6R9XO46ORyMKY X-Gm-Gg: Acq92OFmPvLMsQGtCaWnY/zqwbDyDdz1VjZ2ATvBtdu+lkn7G6uWmoYDdZu1txUWLp2 lWgQzjurp8ahKlvBzAtYZkbqrnVEq2ZMKUfe0ljgiyMaGhAD04z90MgfKmS6wJn5/9fyhboU+rP oS/dUBKrp7QahQlaKtwTJzoie3DQqjayJi/7fOb6P25nIWoa40ZGtBVXaPXWTgDPhbAVUvrzErA Phums4n267yrH39jqKcXDHbsiQMbBbZ6QSzRdbNvj6hnM3Fwsr84L7jolbyzNZf2JRG7i2tn6ph 61zkHjVvs8HajhKcUBIDExGInpxI95S7y57fOLRjnWsZe/GvfJuDUKMGjS1IT7K+oPgXzB5qURB XMJKGWPDPwmmg/RzNqPE4dga6ldR/mPrxoZ8uakewz9MYGRPsAjRseMCAYoeok7SQV4zqmpc7GN KjxvQL69s8HrkX15kyTUUBG1UznsYNqdH+6MzRHSqaENhz9MnQEEsPisG6314= X-Received: by 2002:a17:90b:548e:b0:369:c5f4:9681 with SMTP id 98e67ed59e1d1-370f1339fc0mr8710167a91.22.1780745894325; Sat, 06 Jun 2026 04:38:14 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.38.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:38:13 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:17 +0530 Subject: [PATCH 8/9] iio: magnetometer: hid-sensor-magn-3d: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-8-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: bc1d57ba0669 ("iio: hid-sensors: Added Compass/Magnetometer 3D") Signed-off-by: Sanjay Chitroda --- drivers/iio/magnetometer/hid-sensor-magn-3d.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/ma= gnetometer/hid-sensor-magn-3d.c index 23884825eb00..acae77273bd5 100644 --- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c +++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c @@ -513,12 +513,6 @@ static int hid_magn_3d_probe(struct platform_device *p= dev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - magn_state->callbacks.send_event =3D magn_3d_proc_event; magn_state->callbacks.capture_sample =3D magn_3d_capture_sample; magn_state->callbacks.pdev =3D pdev; @@ -526,13 +520,19 @@ static int hid_magn_3d_probe(struct platform_device *= pdev) &magn_state->callbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &magn_state->magn_flux_attributes); return ret; @@ -545,8 +545,8 @@ static void hid_magn_3d_remove(struct platform_device *= pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct magn_3d_state *magn_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D); hid_sensor_remove_trigger(indio_dev, &magn_state->magn_flux_attributes); } =20 --=20 2.34.1 From nobody Mon Jun 8 06:39:38 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD1B43859D7 for ; Sat, 6 Jun 2026 11:38:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745900; cv=none; b=BRy91DVZ8rheJy2VT/Bb6+tOSasI3YBBcup0nnmArWw5hoiJkS4jXtFaDGSqmywMku5uZBkEmfjo7IvDkg6dyR/+FgxbC94NUQtAzoW1yDtYXI7UCq5dP1UZ+/rfsE4ZX60aGWTAhS/V8fFIFFHfSguPm6ZeUbT5f6xYqCkYQuE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780745900; c=relaxed/simple; bh=tdQv9XeP1nHQ7Q2g9P5Io42IT+SkPtnTaQNAZxqkqp8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=PchH6FT1NgiaQElquj3RP3iI+L0Bex7Sn6D6ek1pyG58Arcr+3XsqvGQ7y+kFjYoLQysP31BKcNqil3voo1MrCK+FEov7Jyfh3te+y7q+1wdnAYqwzci1dtsbrwNk+A9prO8ejvjWOc01FDwoV4lCkv5rmJ9lllE2oPHdDYeFEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TMxaeRZ0; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TMxaeRZ0" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36bdda53d99so1220985a91.0 for ; Sat, 06 Jun 2026 04:38:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780745899; x=1781350699; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=MEHHw98dpwCFQIjo5hdkWP0eBsP9ued+vfNrFXHgBKU=; b=TMxaeRZ0DMS4YisfkNrsfTLIDVgAwkGVQmyEuRNJd8W1jtkIkk5nWBcBeW+uznD1rV iqtLWqSqFdQFtVZ0TFil10ZaVbj9EUy6C5PmEA1sfS2EQMX4HR7WGPzRpfjNJZlgHUsq +n0aFGjwvmXw8Hk2gwGk2R4pfn6qv4Bks83bQWALY7o6OsKbKF/PibxkkBa4nrisLY5G reHgsCGOl1q8Mi7AFfUXPVQU+x4pknv259g/8MayFVc62X4z9EYRL/8iTma26gfLrRFn 4RZBoLaXq/JSS4pr7ySpKzOBzIfBy+ZIweX/tduIF5TayjGozn6frGG74/XinJGZWCoH /beg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780745899; x=1781350699; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=MEHHw98dpwCFQIjo5hdkWP0eBsP9ued+vfNrFXHgBKU=; b=G3QgQb2cFbvVBRaApxy6eeXgyu9aRBmo+ax4+P3l+/BB9wRYCjJdRf1iYQo8SyvCMO zqRyRUGoNWUiepSsELtxyCAiDlyDQhbVkIf3c6ZSoDjbD7OT85gEeIFwi9zc780kS2r4 29wRmHTTQw00w3Gl3DuS8+mBZZlmikoM0vg7oiKImZxwnHb9aITx0PMm2P6wyOW3XeI/ hiInU0lT+FelqSHOn4Gb3wzJYBtB4487D+9QovdiOHFodvDruw4vzvB7fw6Z7lfHrdk5 3w0JcM0xLc4XS3JM6Xetj9NB1o4tauQF0bsdmkL0woUJ3m/oCZ9UU3vAxG11DV0gRQPw kZWg== X-Forwarded-Encrypted: i=1; AFNElJ+4ZpmisATVxyZ92W6cgY7IQxCOBG6SNOcp5+ffzwN4fgrxePTTOa2Wbb3pGkG5ApVqLo1gFHsLmW54cQw=@vger.kernel.org X-Gm-Message-State: AOJu0YwEbjqzu0dcHtZlIyMf08HylnBw4G1vW++0WP2k2diJdFRdh5ui D12mfygzRWOykp0O6gEuAJAxZtFvK4DWVWnF7LiuYvwGEu7HsOBhTaay X-Gm-Gg: Acq92OG1ORha+saV2me9B2t8HT6V9rRjBwBOXhI2Oo1H7SN7IhmkdiITdYCk+9Kfiit cvLmeP6oGOSVJ2EELNpuhmjZEx341Yh1E0o38whcJMi1P7vyA1js3WNrOAqsS3W/Sl75/p9fCyA 0fGKRReG0U2lKXnHzldZYB50U77N5ubsI29zkXJna3Jf9CBQ1x8TDLM96oPStWSMUqnlHU1ST3z O+TCdO3l08Twri/6hKJ+TYsFAsDM/TdpZbeQd01Zu2E5k2K7G15M6w3r6Mr0KHRsX02zHi3Q8cY UsKv6t8pPaRLvz69mgiWGKZ3FgvHt5jKoBk+UAmsjFw6k7mhau+8Xj5AsaOrZUUbAbyYrkxpO08 rgNq5O2e1FP/scqAF6A3WfKm0djUMT+T8onbmz0TfuK8JcSbSKNghOZ/2L5rCvsj5UDL3aSoARX 0TWllFDqFO6/Frz2F0iyQiZf20F9kj1ur7xvV5ReN2UIcw8jn75cicq7Rub2k= X-Received: by 2002:a17:90b:1fc3:b0:36a:fcf5:64d2 with SMTP id 98e67ed59e1d1-370f0b554b4mr9229712a91.16.1780745899160; Sat, 06 Jun 2026 04:38:19 -0700 (PDT) Received: from hu-ckantibh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-371358615aesm3220830a91.2.2026.06.06.04.38.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 06 Jun 2026 04:38:18 -0700 (PDT) From: Sanjay Chitroda X-Google-Original-From: Sanjay Chitroda Date: Sat, 06 Jun 2026 17:07:18 +0530 Subject: [PATCH 9/9] iio: accel: hid-sensor-accel-3d: Fix race between callback registration and device exposure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260606-5-june-hid-iio-race-fixes-v1-9-27a848c5758f@gmail.com> References: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> In-Reply-To: <20260606-5-june-hid-iio-race-fixes-v1-0-27a848c5758f@gmail.com> To: Jiri Kosina , Jonathan Cameron , Srinivas Pandruvada , David Lechner , =?utf-8?q?Nuno_S=C3=A1?= , Andy Shevchenko , Archana Patni , Song Hongyan Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, srinivas pandruvada , Sanjay Chitroda X-Mailer: b4 0.15.2 From: Sanjay Chitroda The driver registers the IIO device before completing sensor hub callback registration and unregisters callbacks while the IIO device is still exposed during teardown. This creates race windows in both probe and remove paths, which can lead to NULL pointer dereferences or use-after-free. Fix this by correct ordering of callback registration and IIO device registration in probe and remove paths. Fixes: 45fe6f7d002c ("iio: hid-sensors: Added accelerometer 3D") Signed-off-by: Sanjay Chitroda --- drivers/iio/accel/hid-sensor-accel-3d.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hi= d-sensor-accel-3d.c index 2bf05ab5235e..c000e001c001 100644 --- a/drivers/iio/accel/hid-sensor-accel-3d.c +++ b/drivers/iio/accel/hid-sensor-accel-3d.c @@ -386,12 +386,6 @@ static int hid_accel_3d_probe(struct platform_device *= pdev) return ret; } =20 - ret =3D iio_device_register(indio_dev); - if (ret) { - dev_err(&pdev->dev, "device register failed\n"); - goto error_remove_trigger; - } - accel_state->callbacks.send_event =3D accel_3d_proc_event; accel_state->callbacks.capture_sample =3D accel_3d_capture_sample; accel_state->callbacks.pdev =3D pdev; @@ -399,13 +393,19 @@ static int hid_accel_3d_probe(struct platform_device = *pdev) &accel_state->callbacks); if (ret < 0) { dev_err(&pdev->dev, "callback reg failed\n"); - goto error_iio_unreg; + goto error_remove_trigger; + } + + ret =3D iio_device_register(indio_dev); + if (ret) { + dev_err(&pdev->dev, "device register failed\n"); + goto error_remove_callback; } =20 return ret; =20 -error_iio_unreg: - iio_device_unregister(indio_dev); +error_remove_callback: + sensor_hub_remove_callback(hsdev, hsdev->usage); error_remove_trigger: hid_sensor_remove_trigger(indio_dev, &accel_state->common_attributes); return ret; @@ -418,8 +418,8 @@ static void hid_accel_3d_remove(struct platform_device = *pdev) struct iio_dev *indio_dev =3D platform_get_drvdata(pdev); struct accel_3d_state *accel_state =3D iio_priv(indio_dev); =20 - sensor_hub_remove_callback(hsdev, hsdev->usage); iio_device_unregister(indio_dev); + sensor_hub_remove_callback(hsdev, hsdev->usage); hid_sensor_remove_trigger(indio_dev, &accel_state->common_attributes); } =20 --=20 2.34.1