* [PATCH 0/2] platform/chrome: check ACPI companions before use
@ 2026-10-28 5:11 Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
0 siblings, 2 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:11 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Mark Hasemeyer, Prashant Malani, Enric Balletbo i Serra,
chrome-platform, linux-kernel
Two Chrome platform drivers assume their firmware-matched devices always
carry an ACPI companion. Driver override can bind either driver to a device
without one, leading probe to dereference a NULL companion.
Reject missing companions before passing them to ACPI resource and notify
handler APIs. Each change is independent and preserves the normal
firmware-matched probe path.
Jiale Yao (2):
platform/chrome: cros_ec_uart: check ACPI companion before use
platform/chrome: cros_usbpd_notify: check ACPI companion
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
2 files changed, 8 insertions(+), 2 deletions(-)
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
@ 2026-10-28 5:11 ` Jiale Yao
2026-10-29 3:20 ` Tzung-Bi Shih
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
1 sibling, 1 reply; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:11 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Prashant Malani, Mark Hasemeyer, chrome-platform, linux-kernel
Cc: stable
cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers
without checking it. A serdev force-bound without an ACPI companion can
therefore cause a NULL pointer dereference during probe.
Reject devices without an ACPI companion before parsing their resources.
Fixes: 04a8bdd135cc ("platform/chrome: cros_ec_uart: Add transport layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
index d5b37414ff12..779aabd16674 100644
--- a/drivers/platform/chrome/cros_ec_uart.c
+++ b/drivers/platform/chrome/cros_ec_uart.c
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
{
- int ret;
+ struct acpi_device *adev;
LIST_HEAD(resources);
- struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ int ret;
+
+ adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ if (!adev)
+ return -ENODEV;
ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
if (ret < 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
@ 2026-10-29 3:20 ` Tzung-Bi Shih
0 siblings, 0 replies; 6+ messages in thread
From: Tzung-Bi Shih @ 2026-10-29 3:20 UTC (permalink / raw)
To: Jiale Yao
Cc: Bhanu Prakash Maiya, Benson Leung, Guenter Roeck, Prashant Malani,
Mark Hasemeyer, chrome-platform, linux-kernel, stable
On Wed, Oct 28, 2026 at 01:11:59PM +0800, Jiale Yao wrote:
> diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
> index d5b37414ff12..779aabd16674 100644
> --- a/drivers/platform/chrome/cros_ec_uart.c
> +++ b/drivers/platform/chrome/cros_ec_uart.c
> @@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
>
> static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
> {
> - int ret;
> + struct acpi_device *adev;
> LIST_HEAD(resources);
> - struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> + int ret;
> +
> + adev = ACPI_COMPANION(&ec_uart->serdev->dev);
> + if (!adev)
> + return -ENODEV;
>
> ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
> if (ret < 0)
NACK, acpi_dev_get_resources() already checks `adev` and return an error
if it is NULL.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
@ 2026-10-28 5:12 ` Jiale Yao
2026-10-29 3:19 ` Tzung-Bi Shih
1 sibling, 1 reply; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:12 UTC (permalink / raw)
To: Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Benson Leung, Tzung-Bi Shih, Enric Balletbo i Serra,
Prashant Malani, chrome-platform, linux-kernel
Cc: stable
The ACPI probe installs a notification handler through the device ACPI
companion without checking that the companion exists. A force-bound
platform device can therefore cause a NULL pointer dereference.
Return -ENODEV before allocating probe resources when the companion is
missing.
Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/platform/chrome/cros_usbpd_notify.c b/drivers/platform/chrome/cros_usbpd_notify.c
index 25da31ec1996..1d82c74583cb 100644
--- a/drivers/platform/chrome/cros_usbpd_notify.c
+++ b/drivers/platform/chrome/cros_usbpd_notify.c
@@ -105,6 +105,8 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev)
acpi_status status;
adev = ACPI_COMPANION(dev);
+ if (!adev)
+ return -ENODEV;
pdnotify = devm_kzalloc(dev, sizeof(*pdnotify), GFP_KERNEL);
if (!pdnotify)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
@ 2026-10-29 3:19 ` Tzung-Bi Shih
0 siblings, 0 replies; 6+ messages in thread
From: Tzung-Bi Shih @ 2026-10-29 3:19 UTC (permalink / raw)
To: Jiale Yao
Cc: Łukasz Bartosik, Andrei Kuchynski, Jameson Thies,
Benson Leung, Enric Balletbo i Serra, Prashant Malani,
chrome-platform, linux-kernel, stable
On Wed, Oct 28, 2026 at 01:12:00PM +0800, Jiale Yao wrote:
> The ACPI probe installs a notification handler through the device ACPI
> companion without checking that the companion exists. A force-bound
> platform device can therefore cause a NULL pointer dereference.
>
> Return -ENODEV before allocating probe resources when the companion is
> missing.
>
> Fixes: 7e91e1ac60bb ("platform/chrome: cros_usbpd_notify: Amend ACPI driver to plat")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
I'll queue this after -rc1 comes out.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use
@ 2026-10-28 5:10 Jiale Yao
0 siblings, 0 replies; 6+ messages in thread
From: Jiale Yao @ 2026-10-28 5:10 UTC (permalink / raw)
To: Bhanu Prakash Maiya, Benson Leung, Tzung-Bi Shih, Guenter Roeck,
Prashant Malani, Mark Hasemeyer, chrome-platform, linux-kernel
Cc: stable
cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers
without checking it. A serdev force-bound without an ACPI companion can
therefore cause a NULL pointer dereference during probe.
Reject devices without an ACPI companion before parsing their resources.
Fixes: 04a8bdd135cc ("platform/chrome: cros_ec_uart: Add transport layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/chrome/cros_ec_uart.c b/drivers/platform/chrome/cros_ec_uart.c
index d5b37414ff12..779aabd16674 100644
--- a/drivers/platform/chrome/cros_ec_uart.c
+++ b/drivers/platform/chrome/cros_ec_uart.c
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
{
- int ret;
+ struct acpi_device *adev;
LIST_HEAD(resources);
- struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ int ret;
+
+ adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+ if (!adev)
+ return -ENODEV;
ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
if (ret < 0)
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-29 3:20 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 5:11 [PATCH 0/2] platform/chrome: check ACPI companions before use Jiale Yao
2026-10-28 5:11 ` [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion " Jiale Yao
2026-10-29 3:20 ` Tzung-Bi Shih
2026-10-28 5:12 ` [PATCH 2/2] platform/chrome: cros_usbpd_notify: check ACPI companion Jiale Yao
2026-10-29 3:19 ` Tzung-Bi Shih
-- strict thread matches above, loose matches on Subject: below --
2026-10-28 5:10 [PATCH 1/2] platform/chrome: cros_ec_uart: check ACPI companion before use Jiale Yao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox