[PATCH 1/3] iio: imu: adis16480: fix unprotected debugfs reads

[PATCH 1/3] iio: imu: adis16480: fix unprotected debugfs reads

[Arka Mondal]

The firmware_revision and firmware_date file operations are open coded
and never call debugfs_file_get(), which debugfs_create_file_unsafe()
requires. debugfs_remove_recursive() therefore does not wait for a read
in progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Fixes: 9bf94f836e32 ("imu:adis16480: fix debugfs_simple_attr.cocci warnings")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
Compile tested only; no relevant hardware available.

 drivers/iio/imu/adis16480.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index e009f3824768..254b7ff25b66 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -309,9 +309,9 @@ static void adis16480_debugfs_init(struct iio_dev *indio_dev)
 	if (!IS_ENABLED(CONFIG_DEBUG_FS))
 		return;
 
-	debugfs_create_file_unsafe("firmware_revision", 0400,
+	debugfs_create_file("firmware_revision", 0400,
 		d, adis16480, &adis16480_firmware_revision_fops);
-	debugfs_create_file_unsafe("firmware_date", 0400,
+	debugfs_create_file("firmware_date", 0400,
 		d, adis16480, &adis16480_firmware_date_fops);
 	debugfs_create_file_unsafe("serial_number", 0400,
 		d, adis16480, &adis16480_serial_number_fops);
-- 
2.55.0

[PATCH 2/3] iio: imu: adis16400: fix unprotected debugfs reads

[Arka Mondal]

The serial_number file operations are open coded and never call
debugfs_file_get(), which debugfs_create_file_unsafe() requires.
debugfs_remove_recursive() therefore does not wait for a read in
progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Fixes: ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
Compile tested only; no relevant hardware available.

 drivers/iio/imu/adis16400.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 36323ad149e0..7e85c1b8dc16 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -280,7 +280,7 @@ static void adis16400_debugfs_init(struct iio_dev *indio_dev)
 		return;
 
 	if (st->variant->flags & ADIS16400_HAS_SERIAL_NUMBER)
-		debugfs_create_file_unsafe("serial_number", 0400,
+		debugfs_create_file("serial_number", 0400,
 				d, st, &adis16400_serial_number_fops);
 	if (st->variant->flags & ADIS16400_HAS_PROD_ID)
 		debugfs_create_file_unsafe("product_id", 0400,
-- 
2.55.0

[PATCH 3/3] iio: gyro: adis16136: fix unprotected debugfs reads

[Arka Mondal]

The serial_number file operations are open coded and never call
debugfs_file_get(), which debugfs_create_file_unsafe() requires.
debugfs_remove_recursive() therefore does not wait for a read in
progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Fixes: 9aaea09b4cbd ("gyro:adis16136: fix debugfs_simple_attr.cocci warnings")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---
Compile tested only; no relevant hardware available.

 drivers/iio/gyro/adis16136.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/adis16136.c b/drivers/iio/gyro/adis16136.c
index 369c7428e1ef..adcf54b67a28 100644
--- a/drivers/iio/gyro/adis16136.c
+++ b/drivers/iio/gyro/adis16136.c
@@ -145,7 +145,7 @@ static int adis16136_debugfs_init(struct iio_dev *indio_dev)
 	struct adis16136 *adis16136 = iio_priv(indio_dev);
 	struct dentry *d = iio_get_debugfs_dentry(indio_dev);
 
-	debugfs_create_file_unsafe("serial_number", 0400,
+	debugfs_create_file("serial_number", 0400,
 		d, adis16136, &adis16136_serial_fops);
 	debugfs_create_file_unsafe("product_id", 0400,
 		d, adis16136, &adis16136_product_id_fops);
-- 
2.55.0

Re: [PATCH 2/3] iio: imu: adis16400: fix unprotected debugfs reads

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 06:07:27PM +0900, Arka Mondal wrote:
> The serial_number file operations are open coded and never call
> debugfs_file_get(), which debugfs_create_file_unsafe() requires.
> debugfs_remove_recursive() therefore does not wait for a read in
> progress, and unbind frees the iio_dev underneath it.
> 
> Use debugfs_create_file() instead.

Have you read the code? Have you read the commit message of the "culprit"
commit?

NAK. Please, revisit all your patches and be careful next time.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/3] iio: imu: adis16480: fix unprotected debugfs reads

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 06:07:26PM +0900, Arka Mondal wrote:
> The firmware_revision and firmware_date file operations are open coded
> and never call debugfs_file_get(), which debugfs_create_file_unsafe()
> requires. debugfs_remove_recursive() therefore does not wait for a read
> in progress, and unbind frees the iio_dev underneath it.
> 
> Use debugfs_create_file() instead.

This one looks correct, but would it be possible to switch to use
DEFINE_DEBUGFS_ATTRIBUTE() instead?

In case Jonathan wants to apply this
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

...

Also whenever send a series, add cover letter to it. Your patch preparing
should be like

	git format-patch --cover-letter --base ... -v <n> ...

where <n> is patch series version number.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 3/3] iio: gyro: adis16136: fix unprotected debugfs reads

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 06:07:28PM +0900, Arka Mondal wrote:
> The serial_number file operations are open coded and never call
> debugfs_file_get(), which debugfs_create_file_unsafe() requires.
> debugfs_remove_recursive() therefore does not wait for a read in
> progress, and unbind frees the iio_dev underneath it.
> 
> Use debugfs_create_file() instead.

Same question as per patch 1.
But if Jonathan likes as is
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 2/3] iio: imu: adis16400: fix unprotected debugfs reads

[Jonathan Cameron]

On Sat, 15 Aug 2026 11:42:30 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Fri, Aug 14, 2026 at 06:07:27PM +0900, Arka Mondal wrote:
> > The serial_number file operations are open coded and never call
> > debugfs_file_get(), which debugfs_create_file_unsafe() requires.
> > debugfs_remove_recursive() therefore does not wait for a read in
> > progress, and unbind frees the iio_dev underneath it.
> > 
> > Use debugfs_create_file() instead.  
> 
> Have you read the code? Have you read the commit message of the "culprit"
> commit?
> 
> NAK. Please, revisit all your patches and be careful next time.
> 
FWIW it is curious that the original patch didn't touch the serial number
declaration whilst touching the other two.  Superficially that looks
like an omission we missed in review.

Jonathan

Re: [PATCH 3/3] iio: gyro: adis16136: fix unprotected debugfs reads

[Jonathan Cameron]

On Sat, 15 Aug 2026 11:49:12 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Fri, Aug 14, 2026 at 06:07:28PM +0900, Arka Mondal wrote:
> > The serial_number file operations are open coded and never call
> > debugfs_file_get(), which debugfs_create_file_unsafe() requires.
> > debugfs_remove_recursive() therefore does not wait for a read in
> > progress, and unbind frees the iio_dev underneath it.
> > 
> > Use debugfs_create_file() instead.  
> 
> Same question as per patch 1.
> But if Jonathan likes as is
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> 

I haven't looked into the tradeoffs fo the two possible solutions,
so would like v2 to have a cover letter and for that to state why
one was chosen over the other.

Thanks

Jonathan

Re: [PATCH 2/3] iio: imu: adis16400: fix unprotected debugfs reads

[Andy Shevchenko]

On Sat, Aug 22, 2026 at 10:37:53PM +0100, Jonathan Cameron wrote:
> On Sat, 15 Aug 2026 11:42:30 +0300
> Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
> 
> > On Fri, Aug 14, 2026 at 06:07:27PM +0900, Arka Mondal wrote:
> > > The serial_number file operations are open coded and never call
> > > debugfs_file_get(), which debugfs_create_file_unsafe() requires.
> > > debugfs_remove_recursive() therefore does not wait for a read in
> > > progress, and unbind frees the iio_dev underneath it.
> > > 
> > > Use debugfs_create_file() instead.  
> > 
> > Have you read the code? Have you read the commit message of the "culprit"
> > commit?
> > 
> > NAK. Please, revisit all your patches and be careful next time.
> > 
> FWIW it is curious that the original patch didn't touch the serial number
> declaration whilst touching the other two.  Superficially that looks
> like an omission we missed in review.

I see, yes, it some strange case of missing piece during review.

-- 
With Best Regards,
Andy Shevchenko