Re: [PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[Sanjay Chitroda <sanjayembeddedse@gmail.com>]

On 25 June 2026 5:46:11 pm IST, Sanjay Chitroda <sanjayembeddedse@gmail.com> wrote:
>From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>
>Avoid using devm_iio_device_register(), as this driver requires explicit
>error handling and teardown ordering.
>
>With devm_iio_device_register(), IIO device remains registered until the
>devres cleanup phase. However, driver's remove() callback removes the
>sensor hub callback and trigger support. This can create a race window
>where IIO device is still visible and read_raw() requests are issued.
>These requests might call sensor_hub_input_attr_get_raw_value(), which
>waits up to 5 seconds for a response from the sensor hub callback that
>has already been removed.
>
>Add an explicit iio_device_unregister() call in the teardown path to
>ensure deterministic cleanup, so that userspace can no longer access the
>device once backend resources begin to be dismantled.
>
>Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
>Cc: stable@vger.kernel.org
>Reviewed-by: Maxwell Doose <m32285159@gmail.com>
>Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
>Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>
Hi Jonathan,

There are two pre-existing issue highlighted by Sashiko which can be analysed and fix in separate change if required.

Requesting your valuable input on this fix. also, this is pre-requisite for HID IIO devm conversation series.

Thanks, Sanjay

>---
>Changes in v2:
>- Added review tags of Maxwell and Andy along with stable Cc
>- Based on input from Srinivas and investigation use-after-free
>  explanation was not sufficiently justified so updated the commit
>  message with appropriate information and kept Fixes tag
>- Link to v1: https://lore.kernel.org/all/20260622052135.1804135-1-sanjayembedded@gmail.com
>---
> drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
>index a8d3a15f9c53..ab6ec8f659b8 100644
>--- a/drivers/iio/temperature/hid-sensor-temperature.c
>+++ b/drivers/iio/temperature/hid-sensor-temperature.c
>@@ -244,7 +244,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
> 	if (ret)
> 		goto error_remove_trigger;
> 
>-	ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
>+	ret = iio_device_register(indio_dev);
> 	if (ret)
> 		goto error_remove_callback;
> 
>@@ -264,6 +264,7 @@ static void hid_temperature_remove(struct platform_device *pdev)
> 	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
> 	struct temperature_state *temp_st = iio_priv(indio_dev);
> 
>+	iio_device_unregister(indio_dev);
> 	sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
> 	hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
> }