[PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[Sanjay Chitroda]

From: Sanjay Chitroda <sanjayembeddedse@gmail.com>

Avoid using devm_iio_device_register(), as this driver requires explicit
error handling and teardown ordering.

With devm_iio_device_register(), IIO device remains registered until the
devres cleanup phase. However, driver's remove() callback removes the
sensor hub callback and trigger support. This can create a race window
where IIO device is still visible and read_raw() requests are issued.
These requests might call sensor_hub_input_attr_get_raw_value(), which
waits up to 5 seconds for a response from the sensor hub callback that
has already been removed.

Add an explicit iio_device_unregister() call in the teardown path to
ensure deterministic cleanup, so that userspace can no longer access the
device once backend resources begin to be dismantled.

Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
Cc: stable@vger.kernel.org
Reviewed-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>

---
Changes in v2:
- Added review tags of Maxwell and Andy along with stable Cc
- Based on input from Srinivas and investigation use-after-free
  explanation was not sufficiently justified so updated the commit
  message with appropriate information and kept Fixes tag
- Link to v1: https://lore.kernel.org/all/20260622052135.1804135-1-sanjayembedded@gmail.com
---
 drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index a8d3a15f9c53..ab6ec8f659b8 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -244,7 +244,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
 	if (ret)
 		goto error_remove_trigger;
 
-	ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
+	ret = iio_device_register(indio_dev);
 	if (ret)
 		goto error_remove_callback;
 
@@ -264,6 +264,7 @@ static void hid_temperature_remove(struct platform_device *pdev)
 	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
 	struct temperature_state *temp_st = iio_priv(indio_dev);
 
+	iio_device_unregister(indio_dev);
 	sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
 	hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
 }
-- 
--

Re: [PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[Sanjay Chitroda]

On 25 June 2026 5:46:11 pm IST, Sanjay Chitroda <sanjayembeddedse@gmail.com> wrote:
>From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>
>Avoid using devm_iio_device_register(), as this driver requires explicit
>error handling and teardown ordering.
>
>With devm_iio_device_register(), IIO device remains registered until the
>devres cleanup phase. However, driver's remove() callback removes the
>sensor hub callback and trigger support. This can create a race window
>where IIO device is still visible and read_raw() requests are issued.
>These requests might call sensor_hub_input_attr_get_raw_value(), which
>waits up to 5 seconds for a response from the sensor hub callback that
>has already been removed.
>
>Add an explicit iio_device_unregister() call in the teardown path to
>ensure deterministic cleanup, so that userspace can no longer access the
>device once backend resources begin to be dismantled.
>
>Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
>Cc: stable@vger.kernel.org
>Reviewed-by: Maxwell Doose <m32285159@gmail.com>
>Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
>Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
>
Hi Jonathan,

There are two pre-existing issue highlighted by Sashiko which can be analysed and fix in separate change if required.

Requesting your valuable input on this fix. also, this is pre-requisite for HID IIO devm conversation series.

Thanks, Sanjay

>---
>Changes in v2:
>- Added review tags of Maxwell and Andy along with stable Cc
>- Based on input from Srinivas and investigation use-after-free
>  explanation was not sufficiently justified so updated the commit
>  message with appropriate information and kept Fixes tag
>- Link to v1: https://lore.kernel.org/all/20260622052135.1804135-1-sanjayembedded@gmail.com
>---
> drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
>index a8d3a15f9c53..ab6ec8f659b8 100644
>--- a/drivers/iio/temperature/hid-sensor-temperature.c
>+++ b/drivers/iio/temperature/hid-sensor-temperature.c
>@@ -244,7 +244,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
> 	if (ret)
> 		goto error_remove_trigger;
> 
>-	ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
>+	ret = iio_device_register(indio_dev);
> 	if (ret)
> 		goto error_remove_callback;
> 
>@@ -264,6 +264,7 @@ static void hid_temperature_remove(struct platform_device *pdev)
> 	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
> 	struct temperature_state *temp_st = iio_priv(indio_dev);
> 
>+	iio_device_unregister(indio_dev);
> 	sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
> 	hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
> }

Re: [PATCH v2] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

[srinivas pandruvada]

On Thu, 2026-06-25 at 17:46 +0530, Sanjay Chitroda wrote:
> From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> 
> Avoid using devm_iio_device_register(), as this driver requires
> explicit
> error handling and teardown ordering.
> 
> With devm_iio_device_register(), IIO device remains registered until
> the
> devres cleanup phase. However, driver's remove() callback removes the
> sensor hub callback and trigger support. This can create a race
> window
> where IIO device is still visible and read_raw() requests are issued.
> These requests might call sensor_hub_input_attr_get_raw_value(),
> which
> waits up to 5 seconds for a response from the sensor hub callback
> that
> has already been removed.
> 
> Add an explicit iio_device_unregister() call in the teardown path to
> ensure deterministic cleanup, so that userspace can no longer access
> the
> device once backend resources begin to be dismantled.
> 
> Fixes: 59d0f2da3569 ("iio: hid: Add temperature sensor support")
> Cc: stable@vger.kernel.org
> Reviewed-by: Maxwell Doose <m32285159@gmail.com>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
> 

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
> Changes in v2:
> - Added review tags of Maxwell and Andy along with stable Cc
> - Based on input from Srinivas and investigation use-after-free
>   explanation was not sufficiently justified so updated the commit
>   message with appropriate information and kept Fixes tag
> - Link to v1:
> https://lore.kernel.org/all/20260622052135.1804135-1-sanjayembedded@gmail.com
> ---
>  drivers/iio/temperature/hid-sensor-temperature.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/temperature/hid-sensor-temperature.c
> b/drivers/iio/temperature/hid-sensor-temperature.c
> index a8d3a15f9c53..ab6ec8f659b8 100644
> --- a/drivers/iio/temperature/hid-sensor-temperature.c
> +++ b/drivers/iio/temperature/hid-sensor-temperature.c
> @@ -244,7 +244,7 @@ static int hid_temperature_probe(struct
> platform_device *pdev)
>  	if (ret)
>  		goto error_remove_trigger;
>  
> -	ret = devm_iio_device_register(indio_dev->dev.parent,
> indio_dev);
> +	ret = iio_device_register(indio_dev);
>  	if (ret)
>  		goto error_remove_callback;
>  
> @@ -264,6 +264,7 @@ static void hid_temperature_remove(struct
> platform_device *pdev)
>  	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
>  	struct temperature_state *temp_st = iio_priv(indio_dev);
>  
> +	iio_device_unregister(indio_dev);
>  	sensor_hub_remove_callback(hsdev,
> HID_USAGE_SENSOR_TEMPERATURE);
>  	hid_sensor_remove_trigger(indio_dev, &temp_st-
> >common_attributes);
>  }