Re: [PATCH v2] usb: typec: ucsi: Add ACPI_COMPANION() NULL check in ucsi_acpi_probe

[Heikki Krogerus]

On Tue, Aug 11, 2026 at 05:58:27PM +0800, Xueqin Luo wrote:
> Add NULL check for ACPI_COMPANION() in ucsi_acpi_probe() to prevent
> NULL pointer dereference when driver_override matches a device without
> ACPI companion.
> 
> Since every platform driver can be forced to match a device that doesn't
> match its list of device IDs because of device_match_driver_override(),
> the ACPI_COMPANION() may return NULL, leading to a NULL pointer
> dereference at adev->dep_unmet.
> 
> Test steps:
> 
>   $ sudo modprobe ucsi_acpi
>   $ echo ucsi_acpi | sudo tee /sys/bus/platform/devices/alarmtimer.0.auto/driver_override
>   $ echo alarmtimer.0.auto | sudo tee /sys/bus/platform/drivers/alarmtimer/unbind
>   $ echo alarmtimer.0.auto | sudo tee /sys/bus/platform/drivers/ucsi_acpi/bind
> 
> which triggered the following crash:
> 
>   [ 6599.180948] calling  ucsi_acpi_platform_driver_init+0x0/0xff0 [ucsi_acpi] @ 24208
>   [ 6599.181198] initcall ucsi_acpi_platform_driver_init+0x0/0xff0 [ucsi_acpi] returned 0 after 207 usecs
>   [ 6729.051074] BUG: kernel NULL pointer dereference, address: 00000000000005f4
>   [ 6729.051102] #PF: supervisor read access in kernel mode
>   [ 6729.051113] #PF: error_code(0x0000) - not-present page
>   [ 6729.051122] PGD 0 P4D 0
>   [ 6729.051136] Oops: 0000 [#1] PREEMPT SMP NOPTI
>   ....
>   [ 6729.051300] PKRU: 55555554
>   [ 6729.051306] Call Trace:
>   [ 6729.051314]  <TASK>
>   [ 6729.051327]  platform_probe+0x41/0xa0
>   [ 6729.051348]  really_probe+0x1a9/0x410
>   [ 6729.051364]  __driver_probe_device+0xc9/0x170
>   [ 6729.051377]  device_driver_attach+0x46/0xb0
>   [ 6729.051390]  bind_store+0x77/0xd0

I don't think kernel can protect the user from everything. I would
rather keep the NULL pointer dereference than silently fail in this
kind of cases.

Note that you can use the driver_override like that also with a device
(not UCSI) that does have the ACPI device node. In that case the probe
would just continue pass the condition you are introducing below.

Thanks,

> Fixes: 1f3546ff3f0a ("usb: typec: ucsi: acpi: Check the _DEP dependencies")
> Signed-off-by: Xueqin Luo <luoxueqin@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> ---
>  drivers/usb/typec/ucsi/ucsi_acpi.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
> index 18286d3e9cc5..b4a783217dc6 100644
> --- a/drivers/usb/typec/ucsi/ucsi_acpi.c
> +++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
> @@ -188,7 +188,7 @@ static void ucsi_acpi_notify(acpi_handle handle, u32 event, void *data)
>  
>  static int ucsi_acpi_probe(struct platform_device *pdev)
>  {
> -	struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
> +	struct acpi_device *adev;
>  	const struct ucsi_operations *ops = &ucsi_acpi_ops;
>  	const struct dmi_system_id *id;
>  	struct ucsi_acpi *ua;
> @@ -196,6 +196,10 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
>  	acpi_status status;
>  	int ret;
>  
> +	adev = ACPI_COMPANION(&pdev->dev);
> +	if (!adev)
> +		return -ENODEV;
> +
>  	if (adev->dep_unmet)
>  		return -EPROBE_DEFER;
>  
> -- 
> 2.43.0

-- 
heikki