[PATCH] platform/x86: asus-wireless: Check ACPI_COMPANION() against NULL

[Linmao Li]

Every platform driver can be forced to match a device that doesn't match
its list of device IDs because of device_match_driver_override(), so
platform drivers that rely on the existence of a device's ACPI companion
object need to verify its presence.

asus_wireless_probe() stores the result of ACPI_COMPANION() without
checking it and still succeeds when it is NULL, because
acpi_match_acpi_device() handles a NULL device gracefully.  Unbinding
the driver afterwards leads to a NULL pointer dereference when
asus_wireless_remove() passes the stored NULL pointer to
acpi_dev_remove_notify_handler(), which dereferences it.

Accordingly, add a requisite ACPI_COMPANION() check against NULL to the
platform/x86 asus-wireless driver.

Fixes: f7e648027d7e ("platform/x86: asus-wireless: Convert ACPI driver to a platform one")
Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
---
 drivers/platform/x86/asus-wireless.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index 2b494bf3cba8..2a43d76a5d19 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -127,11 +127,15 @@ static void asus_wireless_notify(acpi_handle handle, u32 event, void *context)
 
 static int asus_wireless_probe(struct platform_device *pdev)
 {
-	struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
 	struct asus_wireless_data *data;
 	const struct acpi_device_id *id;
+	struct acpi_device *adev;
 	int err;
 
+	adev = ACPI_COMPANION(&pdev->dev);
+	if (!adev)
+		return -ENODEV;
+
 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
-- 
2.25.1