Re: [PATCH] usb: typec: ucsi: Fix NULL pointer dereference in power level debugfs
From: Huang Wei
Date: Sun Oct 11 2026 - 23:16:31 EST
Hi Bertrand,
I checked this over. The window is real - ucsi_register() creates the
debugfs entries right away while ucsi->connector is only assigned at
the end of ucsi_init(), so on the PPM-init-failed path those three
files stay reachable with a NULL connector.
I also grepped debugfs.c for other ucsi->connector dereferences - the
three show functions the patch guards are the only ones (ucsi_resp
and the command interface go through ucsi->debugfs), so the fix is
complete.
One thing I'd note in favour of guarding rather than moving
ucsi_debugfs_register() after connector assignment: the command and
response files are exactly what you want available when the PPM is
misbehaving, so keeping the early registration and just making the
power-level reads fail cleanly looks like the better shape to me.
Reviewed-by: Huang Wei <huangwei@xxxxxxxxxx>
Thanks,
Huang Wei