[PATCH v3 0/2] HID: sensor: custom: Fix fields lifetime issues

[PATCH v3 0/2] HID: sensor: custom: Fix fields lifetime issues

[Haoxiang Li]

Hi,

This series fixes lifetime issues around sensor_inst->fields and the
sysfs attributes that can access it.

The first patch creates the field attributes before exposing enable_sensor
and removes enable_sensor before freeing the field attributes. This keeps
enable_sensor from accessing power_state and report_state pointers after
the fields array has been freed.

The second patch fixes the original field sysfs group leak on probe
failure by unwinding any field groups that were created before a later
sysfs_create_group() failure.

Changes in v3:
 - Move the enable_sensor registration reorder from patch 2 to patch 1.
 - Add a comment explaining why enable_sensor is removed before fields.
 - Add Reported-by and Link tags for the Sashiko review.
 - Keep patch 2 focused on the field sysfs group cleanup. Tanks, Jonathan!

Changes in v2:
 - Split the fix into two patches.
 - Unwind already-created field sysfs groups on failure. Thanks, Jiri!

Haoxiang Li (2):
  HID: sensor: custom: Fix use-after-free in enable_sensor
  HID: sensor: custom: Fix field sysfs group cleanup on failure

 drivers/hid/hid-sensor-custom.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)


base-commit: ef0c9f75a19532d7675384708fc8621e10850104
-- 
2.25.1

[PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor

[Haoxiang Li]

enable_sensor_store() can call set_power_report_state(), which
dereferences sensor_inst->power_state and sensor_inst->report_state.
These pointers refer to entries in sensor_inst->fields.

Create the field attributes before exposing the enable_sensor sysfs
attribute, so enable_sensor cannot be accessed before the state it
depends on has been initialized.

On remove, delete enable_sensor before freeing the field attributes,
so a concurrent sysfs write cannot dereference freed memory through
power_state or report_state.

Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/hid/hid-sensor-custom.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index afffea894021..6b0da2e0e1c9 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -1005,26 +1005,26 @@ static int hid_sensor_custom_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
-				 &enable_sensor_attr_group);
+	ret = hid_sensor_custom_add_attributes(sensor_inst);
 	if (ret)
 		goto err_remove_callback;
 
-	ret = hid_sensor_custom_add_attributes(sensor_inst);
+	ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
+				 &enable_sensor_attr_group);
 	if (ret)
-		goto err_remove_group;
+		goto err_remove_attributes;
 
 	ret = hid_sensor_custom_dev_if_add(sensor_inst);
 	if (ret)
-		goto err_remove_attributes;
+		goto err_remove_group;
 
 	return 0;
 
-err_remove_attributes:
-	hid_sensor_custom_remove_attributes(sensor_inst);
 err_remove_group:
 	sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
 			   &enable_sensor_attr_group);
+err_remove_attributes:
+	hid_sensor_custom_remove_attributes(sensor_inst);
 err_remove_callback:
 	sensor_hub_remove_callback(hsdev, hsdev->usage);
 
@@ -1042,9 +1042,10 @@ static void hid_sensor_custom_remove(struct platform_device *pdev)
 	}
 
 	hid_sensor_custom_dev_if_remove(sensor_inst);
-	hid_sensor_custom_remove_attributes(sensor_inst);
+	/* Remove enable_sensor first as it uses fields via power_state/report_state. */
 	sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
 			   &enable_sensor_attr_group);
+	hid_sensor_custom_remove_attributes(sensor_inst);
 	sensor_hub_remove_callback(hsdev, hsdev->usage);
 }
 
-- 
2.25.1

Re: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Incorrect mapping between the sysfs attribute name index and the `sensor_inst->fields` array leads to Heap Out-Of-Bounds reads.
- [High] The `/dev/HID-SENSOR-*` character device operations do not synchronize with device removal, leading to Use-After-Free on `devm`-managed structures.
- [High] The `data_fifo` is freed before the sensor hub interrupt callback is unregistered during device removal, creating a race condition that leads to a Use-After-Free.
- [High] The sensor hub device is never closed on driver removal if it was concurrently enabled, causing a permanent power and reference count leak.
--

--- Patch [1]: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor ---
commit d433ad359db5f5f5744d4b3f8a4dc8088af760b6
Author: Haoxiang Li <haoxiang_li2024@163.com>

HID: sensor: custom: Fix use-after-free in enable_sensor

This commit fixes a use-after-free by altering the initialization and cleanup
order of the sysfs attributes and the enable_sensor group. This prevents
enable_sensor from being accessed before its dependencies are fully
initialized or after they have been freed.

Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1

> diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
> index afffea8940214..6b0da2e0e1c93 100644
> --- a/drivers/hid/hid-sensor-custom.c
> +++ b/drivers/hid/hid-sensor-custom.c
> @@ -1005,26 +1005,26 @@ static int hid_sensor_custom_probe(struct platform_device *pdev)
>  		return ret;
>  	}
>  
> -	ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
> -				 &enable_sensor_attr_group);
> +	ret = hid_sensor_custom_add_attributes(sensor_inst);

[Severity: Critical]
This is a pre-existing issue, but is there an out-of-bounds read when parsing
the sysfs strings created by this function?

During initialization, if a HID field is skipped, it is not appended to the
sensor_inst->fields array, keeping sensor_field_count small. However, its
original field index is embedded into the sysfs file name.

When a valid sysfs file is later read, show_value() parses the index from
the filename and uses it directly as an array index:

    if (sscanf(attr->attr.name, "input-%x-%x-%s",
               &index, &usage, name) == 3) {
        input = true;
        field_index = index;
    }
    ...
    value = sensor_inst->fields[field_index].attribute.logical_minimum;

Could this bypass the array bounds and leak memory to userspace?

[ ... ]

> @@ -1042,9 +1042,10 @@ static void hid_sensor_custom_remove(struct platform_device *pdev)
>  	}
>  
>  	hid_sensor_custom_dev_if_remove(sensor_inst);

[Severity: High]
This isn't a bug introduced by this patch, but doesn't this leave a
use-after-free window?

If a user holds open the misc device /dev/HID-SENSOR-*, misc_deregister()
does not close existing open file descriptors. Since sensor_inst is
allocated with devm_kzalloc(), it is freed when remove() returns.

Would subsequent calls to hid_sensor_custom_read(), poll(), or
hid_sensor_custom_release() dereference the freed sensor_inst object?

[Severity: High]
This is a pre-existing issue, but is there a race condition here?

The data_fifo is freed by hid_sensor_custom_dev_if_remove() before the
interrupt callback is unregistered by sensor_hub_remove_callback().

If an interrupt occurs while sysfs_remove_group() or
hid_sensor_custom_remove_attributes() is blocking, couldn't the callback
hid_sensor_capture_sample() write incoming data to the freed data_fifo
via kfifo_in()?

[Severity: High]
This is also a pre-existing issue, but does this function leak the sensor hub
reference and power state?

If a user writes '1' to the enable_sensor sysfs attribute,
sensor_hub_device_open() powers on the device and takes a reference. Since
this function tears down the interfaces without checking sensor_inst->enable
and calling sensor_hub_device_close(), does the HID device reference leak
permanently?

> -	hid_sensor_custom_remove_attributes(sensor_inst);
> +	/* Remove enable_sensor first as it uses fields via power_state/report_state. */
>  	sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
>  			   &enable_sensor_attr_group);
> +	hid_sensor_custom_remove_attributes(sensor_inst);
>  	sensor_hub_remove_callback(hsdev, hsdev->usage);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707071545.3087073-1-haoxiang_li2024@163.com?part=1

Re: [PATCH v3 1/2] HID: sensor: custom: Fix use-after-free in enable_sensor

[srinivas pandruvada]

On Tue, 2026-07-07 at 15:15 +0800, Haoxiang Li wrote:
> enable_sensor_store() can call set_power_report_state(), which
> dereferences sensor_inst->power_state and sensor_inst->report_state.
> These pointers refer to entries in sensor_inst->fields.
> 
> Create the field attributes before exposing the enable_sensor sysfs
> attribute, so enable_sensor cannot be accessed before the state it
> depends on has been initialized.
> 
> On remove, delete enable_sensor before freeing the field attributes,
> so a concurrent sysfs write cannot dereference freed memory through
> power_state or report_state.
> 
> Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
> Link:
> https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1
> Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor
> support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  drivers/hid/hid-sensor-custom.c | 17 +++++++++--------
>  1 file changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-
> sensor-custom.c
> index afffea894021..6b0da2e0e1c9 100644
> --- a/drivers/hid/hid-sensor-custom.c
> +++ b/drivers/hid/hid-sensor-custom.c
> @@ -1005,26 +1005,26 @@ static int hid_sensor_custom_probe(struct
> platform_device *pdev)
>  		return ret;
>  	}
>  
> -	ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
> -				 &enable_sensor_attr_group);
> +	ret = hid_sensor_custom_add_attributes(sensor_inst);
>  	if (ret)
>  		goto err_remove_callback;
>  
> -	ret = hid_sensor_custom_add_attributes(sensor_inst);
> +	ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj,
> +				 &enable_sensor_attr_group);
>  	if (ret)
> -		goto err_remove_group;
> +		goto err_remove_attributes;
>  
>  	ret = hid_sensor_custom_dev_if_add(sensor_inst);
>  	if (ret)
> -		goto err_remove_attributes;
> +		goto err_remove_group;
>  
>  	return 0;
>  
> -err_remove_attributes:
> -	hid_sensor_custom_remove_attributes(sensor_inst);
>  err_remove_group:
>  	sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
>  			   &enable_sensor_attr_group);
> +err_remove_attributes:
> +	hid_sensor_custom_remove_attributes(sensor_inst);
>  err_remove_callback:
>  	sensor_hub_remove_callback(hsdev, hsdev->usage);
>  
> @@ -1042,9 +1042,10 @@ static void hid_sensor_custom_remove(struct
> platform_device *pdev)
>  	}
>  
>  	hid_sensor_custom_dev_if_remove(sensor_inst);
> -	hid_sensor_custom_remove_attributes(sensor_inst);
> +	/* Remove enable_sensor first as it uses fields via
> power_state/report_state. */
>  	sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
>  			   &enable_sensor_attr_group);
> +	hid_sensor_custom_remove_attributes(sensor_inst);
>  	sensor_hub_remove_callback(hsdev, hsdev->usage);
>  }
>  

[PATCH v3 2/2] HID: sensor: custom: Fix field sysfs group cleanup on failure

[Haoxiang Li]

hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.

Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.

Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/hid/hid-sensor-custom.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 6b0da2e0e1c9..c2b425afd951 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
 					 &sensor_inst->fields[i].
 					 hid_custom_attribute_group);
 		if (ret)
-			break;
+			goto err_remove_groups;
 
 		/* For power or report field store indexes */
 		if (sensor_inst->fields[i].attribute.attrib_id ==
@@ -621,6 +621,13 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
 	}
 
 	return ret;
+
+err_remove_groups:
+	while (--i >= 0)
+		sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
+				   &sensor_inst->fields[i].hid_custom_attribute_group);
+	kfree(sensor_inst->fields);
+	return ret;
 }
 
 static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *
-- 
2.25.1

Re: [PATCH v3 2/2] HID: sensor: custom: Fix field sysfs group cleanup on failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Lifetime mismatch between `devm_kzalloc` allocated `sensor_inst` and `miscdevice` file operations leads to a Use-After-Free.
- [High] Race condition in `hid_sensor_custom_remove()` between event callback removal and kfifo destruction allows Use-After-Free.
--

--- Patch [2]: [PATCH v3 2/2] HID: sensor: custom: Fix field sysfs group cleanup on failure ---
commit aa8aaa0518fc58fa29db9643742276c6a56cafe6
Author: Haoxiang Li <haoxiang_li2024@163.com>

HID: sensor: custom: Fix field sysfs group cleanup on failure
    
hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.
    
Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.

Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org

> diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
> index 6b0da2e0e1c93..c2b425afd951b 100644
> --- a/drivers/hid/hid-sensor-custom.c
> +++ b/drivers/hid/hid-sensor-custom.c
> @@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom
[ ... ]
>  	return ret;
> +
> +err_remove_groups:
> +	while (--i >= 0)
> +		sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
> +				   &sensor_inst->fields[i].hid_custom_attribute_group);
> +	kfree(sensor_inst->fields);
> +	return ret;
>  }
>  
>  static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *

[Severity: High]
This is a pre-existing issue, but is there a lifetime mismatch between the
devm_kzalloc() allocated sensor_inst and the miscdevice file operations?

In hid_sensor_custom_probe(), sensor_inst is allocated with device-managed
memory:

    sensor_inst = devm_kzalloc(&pdev->dev, sizeof(*sensor_inst),
                               GFP_KERNEL);

When the device is unbound, devres will automatically free sensor_inst.
However, misc_deregister() does not revoke existing open file descriptors.

If a user has the character device open, unbinds the device, and then
interacts with the file descriptor, could this lead to a use-after-free?

For example, hid_sensor_custom_read() accesses the freed pointer:

    sensor_inst = container_of(file->private_data,
                               struct hid_sensor_custom, custom_dev);

Similarly, closing the file calls hid_sensor_custom_release() which modifies
the freed memory:

    clear_bit(0, &sensor_inst->misc_opened);

[Severity: High]
This is a pre-existing issue, but is there a race condition in
hid_sensor_custom_remove() during device teardown?

The function first frees the data buffer:

    hid_sensor_custom_dev_if_remove(sensor_inst); // calls kfifo_free()

It removes the callback later in the function:

    sensor_hub_remove_callback(hsdev, hsdev->usage);

If the sensor hub receives an asynchronous hardware event between these two
calls, wouldn't the still-active callback invoke hid_sensor_capture_sample()
and write incoming hardware data to the freed data_fifo?

    kfifo_in(&sensor_inst->data_fifo, (unsigned char *)raw_data,
             raw_len);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707071545.3087073-1-haoxiang_li2024@163.com?part=2

Re: [PATCH v3 2/2] HID: sensor: custom: Fix field sysfs group cleanup on failure

[srinivas pandruvada]

On Tue, 2026-07-07 at 15:15 +0800, Haoxiang Li wrote:
> hid_sensor_custom_add_attributes() creates one sysfs group for each
> custom sensor field. If sysfs_create_group() fails after some groups
> have already been created, the function returns the error without
> removing the previously created groups.
> 
> Add a local unwind path to remove the groups that were already
> created.
> With enable_sensor exposed only after the field attributes are ready,
> this path can free sensor_inst->fields without leaving enable_sensor
> able to access pointers into that array.
> 
> Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor
> support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  drivers/hid/hid-sensor-custom.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-
> sensor-custom.c
> index 6b0da2e0e1c9..c2b425afd951 100644
> --- a/drivers/hid/hid-sensor-custom.c
> +++ b/drivers/hid/hid-sensor-custom.c
> @@ -609,7 +609,7 @@ static int
> hid_sensor_custom_add_attributes(struct hid_sensor_custom
>  					 &sensor_inst->fields[i].
>  					
> hid_custom_attribute_group);
>  		if (ret)
> -			break;
> +			goto err_remove_groups;
>  
>  		/* For power or report field store indexes */
>  		if (sensor_inst->fields[i].attribute.attrib_id ==
> @@ -621,6 +621,13 @@ static int
> hid_sensor_custom_add_attributes(struct hid_sensor_custom
>  	}
>  
>  	return ret;
> +
> +err_remove_groups:
> +	while (--i >= 0)
> +		sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
> +				   &sensor_inst-
> >fields[i].hid_custom_attribute_group);
> +	kfree(sensor_inst->fields);
> +	return ret;
>  }
>  
>  static void hid_sensor_custom_remove_attributes(struct
> hid_sensor_custom *

Re: [PATCH v3 0/2] HID: sensor: custom: Fix fields lifetime issues

[Jonathan Cameron]

On Tue,  7 Jul 2026 15:15:43 +0800
Haoxiang Li <haoxiang_li2024@163.com> wrote:

> Hi,
> 
> This series fixes lifetime issues around sensor_inst->fields and the
> sysfs attributes that can access it.
> 
> The first patch creates the field attributes before exposing enable_sensor
> and removes enable_sensor before freeing the field attributes. This keeps
> enable_sensor from accessing power_state and report_state pointers after
> the fields array has been freed.
> 
> The second patch fixes the original field sysfs group leak on probe
> failure by unwinding any field groups that were created before a later
> sysfs_create_group() failure.
Series applied to the fixes-togreg branch of iio.git

Thanks,

Jonathan

> 
> Changes in v3:
>  - Move the enable_sensor registration reorder from patch 2 to patch 1.
>  - Add a comment explaining why enable_sensor is removed before fields.
>  - Add Reported-by and Link tags for the Sashiko review.
>  - Keep patch 2 focused on the field sysfs group cleanup. Tanks, Jonathan!
> 
> Changes in v2:
>  - Split the fix into two patches.
>  - Unwind already-created field sysfs groups on failure. Thanks, Jiri!
> 
> Haoxiang Li (2):
>   HID: sensor: custom: Fix use-after-free in enable_sensor
>   HID: sensor: custom: Fix field sysfs group cleanup on failure
> 
>  drivers/hid/hid-sensor-custom.c | 26 +++++++++++++++++---------
>  1 file changed, 17 insertions(+), 9 deletions(-)
> 
> 
> base-commit: ef0c9f75a19532d7675384708fc8621e10850104