[PATCH 0/2] platform/chrome: check ACPI companions before use

[PATCH 0/2] platform/chrome: check ACPI companions before use

[Jiale Yao]

Two Chrome platform drivers assume their firmware-matched devices always
carry an ACPI companion. Driver override can bind either driver to a device
without one, leading probe to dereference a NULL companion.

Reject missing companions before passing them to ACPI resource and notify
handler APIs. Each change is independent and preserves the normal
firmware-matched probe path.

Jiale Yao (2):
  platform/chrome: cros_ec_uart: check ACPI companion before use
  platform/chrome: cros_usbpd_notify: check ACPI companion

 drivers/platform/chrome/cros_ec_uart.c      | 8 ++++++--
 drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
 2 files changed, 8 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use

[Jiale Yao]

cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers
without checking it. A serdev force-bound without an ACPI companion can
therefore cause a NULL pointer dereference during probe.

Reject devices without an ACPI companion before parsing their resources.

Fixes: 04a8bdd135cc ("platform/chrome: cros_ec_uart: Add transport layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
index d5b37414ff12..779aabd16674 100644
--- a/drivers/platform/chrome/cros_ec_uart.c
+++ b/drivers/platform/chrome/cros_ec_uart.c
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
 
 static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
 {
-	int ret;
+	struct acpi_device *adev;
 	LIST_HEAD(resources);
-	struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+	int ret;
+
+	adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+	if (!adev)
+		return -ENODEV;
 
 	ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
 	if (ret < 0)
-- 
2.34.1

Re: [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use

[Tzung-Bi Shih]

On Wed, Oct 28, 2026 at 01:11:59PM +0800, Jiale Yao wrote:
> diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
> index d5b37414ff12..779aabd16674 100644
> --- a/drivers/platform/chrome/cros_ec_uart.c
> +++ b/drivers/platform/chrome/cros_ec_uart.c
> @@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
>  
>  static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
>  {
> -	int ret;
> +	struct acpi_device *adev;
>  	LIST_HEAD(resources);
> -	struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> +	int ret;
> +
> +	adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> +	if (!adev)
> +		return -ENODEV;
>  
>  	ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
>  	if (ret < 0)

NACK, acpi_dev_get_resources() already checks `adev` and return an error
if it is NULL.

[PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion

[Jiale Yao]

The ACPI probe installs a notification handler through the device ACPI
companion without checking that the companion exists. A force-bound
platform device can therefore cause a NULL pointer dereference.

Return -ENODEV before allocating probe resources when the companion is
missing.

Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/platform/chrome/cros_usbpd_notify.c b/drivers/platform/chrome/cros_usbpd_notify.c
index 25da31ec1996..1d82c74583cb 100644
--- a/drivers/platform/chrome/cros_usbpd_notify.c
+++ b/drivers/platform/chrome/cros_usbpd_notify.c
@@ -105,6 +105,8 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev)
 	acpi_status status;
 
 	adev = ACPI_COMPANION(dev);
+	if (!adev)
+		return -ENODEV;
 
 	pdnotify = devm_kzalloc(dev, sizeof(*pdnotify), GFP_KERNEL);
 	if (!pdnotify)
-- 
2.34.1

Re: [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion

[Tzung-Bi Shih]

On Wed, Oct 28, 2026 at 01:12:00PM +0800, Jiale Yao wrote:
> The ACPI probe installs a notification handler through the device ACPI
> companion without checking that the companion exists. A force-bound
> platform device can therefore cause a NULL pointer dereference.
> 
> Return -ENODEV before allocating probe resources when the companion is
> missing.
> 
> Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

I'll queue this after -rc1 comes out.

[PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion

[Jiale Yao]

The ACPI probe installs a notification handler through the device ACPI
companion without checking that the companion exists. A force-bound
platform device can therefore cause a NULL pointer dereference.

Return -ENODEV before allocating probe resources when the companion is
missing.

Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/platform/chrome/cros_usbpd_notify.c b/drivers/platform/chrome/cros_usbpd_notify.c
index 25da31ec1996..1d82c74583cb 100644
--- a/drivers/platform/chrome/cros_usbpd_notify.c
+++ b/drivers/platform/chrome/cros_usbpd_notify.c
@@ -105,6 +105,8 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev)
 	acpi_status status;
 
 	adev = ACPI_COMPANION(dev);
+	if (!adev)
+		return -ENODEV;
 
 	pdnotify = devm_kzalloc(dev, sizeof(*pdnotify), GFP_KERNEL);
 	if (!pdnotify)
-- 
2.34.1