Re: [PATCH 1/3] iio: hid-sensor-temperature: use u32 instead of unsigned int

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Tear-down Order Inversion / Use-After-Free
--

commit fd38c3c8f2adbbb955807f745b5f193e1fd40a85
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: hid-sensor-temperature: use u32 instead of unsigned int
    
This commit updates the type of the usage_id variable from unsigned int
to u32 in the callback API. This improves code clarity and matches the
expected callback API type.

> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
> index 9f628a8e5cfbe..a8d3a15f9c531 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c

[ ... ]

> @@ -159,7 +159,7 @@ static int temperature_capture_sample(struct hid_sensor_hub_device *hsdev,
>  static int temperature_parse_report(struct platform_device *pdev,
>  				struct hid_sensor_hub_device *hsdev,
>  				struct iio_chan_spec *channels,
> -				unsigned int usage_id,
> +				u32 usage_id,
>  				struct temperature_state *st)
>  {
>  	int ret;

[Severity: High]
This is a pre-existing issue, but does hid_temperature_remove() tear down
the trigger and callback too early?

Because the driver uses devm_iio_device_register(), the IIO device will not
be unregistered until after the driver's remove function returns.

However, hid_temperature_remove() manually unregisters the trigger and
callbacks before that:

drivers/iio/temperature/hid-sensor-temperature.c:hid_temperature_remove() {
	...
	sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
	hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
}

Could this leave a race condition window where the IIO device and its
sysfs/char interfaces are still fully accessible to userspace, but its
backing trigger and callbacks have already been destroyed?

Can concurrent access from userspace during this window lead to a
use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616-16-jun-hid-iio-u32-api-type-v1-0-952c74195f46@gmail.com?part=1