Re: [PATCH] usb: typec: ucsi: Fix NULL pointer dereference in power level debugfs

From: Huang Wei

Date: Sun Oct 11 2026 - 23:16:31 EST


Hi Bertrand,

I checked this over. The window is real - ucsi_register() creates the
debugfs entries right away while ucsi->connector is only assigned at
the end of ucsi_init(), so on the PPM-init-failed path those three
files stay reachable with a NULL connector.

I also grepped debugfs.c for other ucsi->connector dereferences - the
three show functions the patch guards are the only ones (ucsi_resp
and the command interface go through ucsi->debugfs), so the fix is
complete.

One thing I'd note in favour of guarding rather than moving
ucsi_debugfs_register() after connector assignment: the command and
response files are exactly what you want available when the PPM is
misbehaving, so keeping the early registration and just making the
power-level reads fail cleanly looks like the better shape to me.

Reviewed-by: Huang Wei <huangwei@xxxxxxxxxx>

Thanks,
Huang Wei