Re: [PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[srinivas pandruvada <srinivas.pandruvada@linux.intel.com>]

On Thu, 2026-06-25 at 17:46 +0530, Sanjay Chitroda wrote:
> From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> 
> Avoid using devm_iio_device_register(), as this driver requires
> explicit
> error handling and teardown ordering.
> 
> With devm_iio_device_register(), IIO device remains registered until
> the
> devres cleanup phase. However, driver's remove() callback removes the
> sensor hub callback and trigger support. This can create a race
> window
> where IIO device is still visible and read_raw() requests are issued.
> These requests might call sensor_hub_input_attr_get_raw_value(),
> which
> waits up to 5 seconds for a response from the sensor hub callback
> that
> has already been removed.
> 
> Add an explicit iio_device_unregister() call in the teardown path to
> ensure deterministic cleanup, so that userspace can no longer access
> the
> device once backend resources begin to be dismantled.
> 
> Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
> Cc: stable@vger.kernel.org
> Reviewed-by: Maxwell Doose <m32285159@gmail.com>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> 

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
> Changes in v2:
> - Added review tags of Maxwell and Andy along with stable Cc
> - Based on input from Srinivas and investigation use-after-free
>   explanation was not sufficiently justified so updated the commit
>   message with appropriate information and kept Fixes tag
> - Link to v1:
> https://lore.kernel.org/all/20260622052135.1804135-1-sanjayembedded@gmail.com
> ---
>  drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c
> b/drivers/iio/temperature/hid-sensor-temperature.c
> index a8d3a15f9c53..ab6ec8f659b8 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c
> @@ -244,7 +244,7 @@ static int hid_temperature_probe(struct
> platform_device *pdev)
>  	if (ret)
>  		goto error_remove_trigger;
>  
> -	ret = devm_iio_device_register(indio_dev->dev.parent,
> indio_dev);
> +	ret = iio_device_register(indio_dev);
>  	if (ret)
>  		goto error_remove_callback;
>  
> @@ -264,6 +264,7 @@ static void hid_temperature_remove(struct
> platform_device *pdev)
>  	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
>  	struct temperature_state *temp_st = iio_priv(indio_dev);
>  
> +	iio_device_unregister(indio_dev);
>  	sensor_hub_remove_callback(hsdev,
> HID_USAGE_SENSOR_TEMPERATURE);
>  	hid_sensor_remove_trigger(indio_dev, &temp_st-
> >common_attributes);
>  }