* [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
@ 2026-10-28 5:10 Jiale Yao
0 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:10 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Prashant Malani, Mark Hasemeyer, chrome-platform, linux-kernel
Cc: stable
cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers
without checking it. A serdev force-bound without an ACPI companion can
therefore cause a NULL pointer dereference during probe.
Reject devices without an ACPI companion before parsing their resources.
Fixes: 04a8bdd135cc ("platform/chrome: cros_ec_uart: Add transport layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
index d5b37414ff12..779aabd16674 100644
--- a/drivers/platform/chrome/cros_ec_uart.c
+++ b/drivers/platform/chrome/cros_ec_uart.c
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
{
- int ret;
+ struct acpi_device *adev;
LIST_HEAD(resources);
- struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ int ret;
+
+ adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ if (!adev)
+ return -ENODEV;
ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
if (ret < 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 0/2] platform/chrome: check ACPI companions before use
@ 2026-10-28 5:11 Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
0 siblings, 2 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:11 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Mark Hasemeyer, Prashant Malani, Enric Balletbo i Serra,
chrome-platform, linux-kernel
Two Chrome platform drivers assume their firmware-matched devices always
carry an ACPI companion. Driver override can bind either driver to a device
without one, leading probe to dereference a NULL companion.
Reject missing companions before passing them to ACPI resource and notify
handler APIs. Each change is independent and preserves the normal
firmware-matched probe path.
Jiale Yao (2):
platform/chrome: cros_ec_uart: check ACPI companion before use
platform/chrome: cros_usbpd_notify: check ACPI companion
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
2 files changed, 8 insertions(+), 2 deletions(-)
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
@ 2026-10-28 5:11 ` Jiale Yao
2026-10-29 3:20 ` Tzung-Bi Shih
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
1 sibling, 1 reply; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:11 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Prashant Malani, Mark Hasemeyer, chrome-platform, linux-kernel
Cc: stable
cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers
without checking it. A serdev force-bound without an ACPI companion can
therefore cause a NULL pointer dereference during probe.
Reject devices without an ACPI companion before parsing their resources.
Fixes: 04a8bdd135cc ("platform/chrome: cros_ec_uart: Add transport layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
index d5b37414ff12..779aabd16674 100644
--- a/drivers/platform/chrome/cros_ec_uart.c
+++ b/drivers/platform/chrome/cros_ec_uart.c
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
{
- int ret;
+ struct acpi_device *adev;
LIST_HEAD(resources);
- struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ int ret;
+
+ adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ if (!adev)
+ return -ENODEV;
ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
if (ret < 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
@ 2026-10-28 5:12 ` Jiale Yao
2026-10-29 3:19 ` Tzung-Bi Shih
1 sibling, 1 reply; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:12 UTC (permalink / raw)
To: Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Benson Leung, Tzung-Bi Shih, Enric Balletbo i Serra,
Prashant Malani, chrome-platform, linux-kernel
Cc: stable
The ACPI probe installs a notification handler through the device ACPI
companion without checking that the companion exists. A force-bound
platform device can therefore cause a NULL pointer dereference.
Return -ENODEV before allocating probe resources when the companion is
missing.
Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/platform/chrome/cros_usbpd_notify.c b/drivers/platform/chrome/cros_usbpd_notify.c
index 25da31ec1996..1d82c74583cb 100644
--- a/drivers/platform/chrome/cros_usbpd_notify.c
+++ b/drivers/platform/chrome/cros_usbpd_notify.c
@@ -105,6 +105,8 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev)
acpi_status status;
adev = ACPI_COMPANION(dev);
+ if (!adev)
+ return -ENODEV;
pdnotify = devm_kzalloc(dev, sizeof(*pdnotify), GFP_KERNEL);
if (!pdnotify)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
@ 2026-10-29 3:19 ` Tzung-Bi Shih
0 siblings, 0 replies; 6+ messages in thread
From: Tzung-Bi Shih @ 2026-10-29 3:19 UTC (permalink / raw)
To: Jiale Yao
Cc: Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Benson Leung, Enric Balletbo i Serra, Prashant Malani,
chrome-platform, linux-kernel, stable
On Wed, Oct 28, 2026 at 01:12:00PM +0800, Jiale Yao wrote:
> The ACPI probe installs a notification handler through the device ACPI
> companion without checking that the companion exists. A force-bound
> platform device can therefore cause a NULL pointer dereference.
>
> Return -ENODEV before allocating probe resources when the companion is
> missing.
>
> Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
I'll queue this after -rc1 comes out.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
@ 2026-10-29 3:20 ` Tzung-Bi Shih
0 siblings, 0 replies; 6+ messages in thread
From: Tzung-Bi Shih @ 2026-10-29 3:20 UTC (permalink / raw)
To: Jiale Yao
Cc: Bhanu Prakash Maiya, Benson Leung, Guenter Roeck, Prashant Malani,
Mark Hasemeyer, chrome-platform, linux-kernel, stable
On Wed, Oct 28, 2026 at 01:11:59PM +0800, Jiale Yao wrote:
> diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
> index d5b37414ff12..779aabd16674 100644
> --- a/drivers/platform/chrome/cros_ec_uart.c
> +++ b/drivers/platform/chrome/cros_ec_uart.c
> @@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
>
> static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
> {
> - int ret;
> + struct acpi_device *adev;
> LIST_HEAD(resources);
> - struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> + int ret;
> +
> + adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> + if (!adev)
> + return -ENODEV;
>
> ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
> if (ret < 0)
NACK, acpi_dev_get_resources() already checks `adev` and return an error
if it is NULL.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-29 3:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
2026-10-29 3:20 ` Tzung-Bi Shih
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
2026-10-29 3:19 ` Tzung-Bi Shih
-- strict thread matches above, loose matches on Subject: below --
2026-10-28 5:10 [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use Jiale Yao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.