Re: [PATCH v5 06/13] iio: humidity: hid-sensor-humidity: convert probe and teardown to devm-managed resources

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Shared global `humidity_callbacks` structure causes `.pdev` pointer overwrite, leading to state corruption and use-after-free when multiple humidity sensors are present.
--

--- Patch [6]: [PATCH v5 06/13] iio: humidity: hid-sensor-humidity: convert probe and teardown to devm-managed resources ---
commit 56374932f747b4eb1a636c154cf264875bcdacc6
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: humidity: hid-sensor-humidity: convert probe and teardown to devm-managed resources

This commit converts the HID IIO driver resource management to use
devm-managed helpers. This ties the lifetime of all resources to the
device, simplifies error handling in the probe path, and removes the
explicit remove callback entirely.

> diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
> --- a/drivers/iio/humidity/hid-sensor-humidity.c
> +++ b/drivers/iio/humidity/hid-sensor-humidity.c
[ ... ]
> @@ -233,42 +234,20 @@ static int hid_humidity_probe(struct platform_device *pdev)
>  	platform_set_drvdata(pdev, indio_dev);
>  
>  	humidity_callbacks.pdev = pdev;
> -	ret = sensor_hub_register_callback(hsdev, HID_USAGE_SENSOR_HUMIDITY,
> -					   &humidity_callbacks);
> +	ret = devm_sensor_hub_register_callback(dev, hsdev, HID_USAGE_SENSOR_HUMIDITY,
> +						&humidity_callbacks);

[Severity: High]
This is a pre-existing issue, but does assigning pdev to the shared global
humidity_callbacks structure risk state corruption and a use-after-free?

If multiple humidity sensors are probed, the last probed device overwrites
this global pointer. If that last device is later removed, the global pdev
pointer will point to freed memory.

When an event later arrives for the remaining active device,
humidity_proc_event() will dereference the freed pdev:

static int humidity_proc_event(struct hid_sensor_hub_device *hsdev,
                               u32 usage_id, void *pdev)
{
        struct iio_dev *indio_dev = platform_get_drvdata(pdev);
        ...
}

Should humidity_callbacks be dynamically allocated per-device or stored
within the device's private data rather than shared globally?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-28-apr-iio-redundant-argument-v5-temp-v5-0-f1f92c1d830f@gmail.com?part=6