[PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()

[PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()

[Deepanshu Kartikey]

ucsi_acpi_probe() dereferences the ACPI companion device pointer
returned by ACPI_COMPANION() without checking it for NULL. While
this driver is normally probed through ACPI device enumeration
where a companion is always present, a platform_device can also be
manually bound to any platform driver via the sysfs 'bind' file
(bind_store() -> bus_find_device() -> driver_attach_device()),
which matches purely on device name and bypasses ACPI matching.

If ucsi_acpi is bound this way to a platform device with no ACPI
companion, ACPI_COMPANION() returns NULL and the subsequent
adev->dep_unmet access dereferences a NULL pointer, resulting in a
general protection fault.

Add a NULL check for adev immediately after it is obtained and
before any resource allocation, returning -ENODEV to decline
binding cleanly.

Reported-by: syzbot+23cf45a9fce78e4e0dc1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23cf45a9fce78e4e0dc1
Tested-by: syzbot+23cf45a9fce78e4e0dc1@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/usb/typec/ucsi/ucsi_acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
index 18286d3e9cc5..9fe4ba43afea 100644
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -196,6 +196,9 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
 	acpi_status status;
 	int ret;
 
+	if (!adev)
+		return -ENODEV;
+
 	if (adev->dep_unmet)
 		return -EPROBE_DEFER;
 
-- 
2.43.0

Re: [PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()

[Greg KH]

On Fri, Aug 21, 2026 at 05:49:09PM +0530, Deepanshu Kartikey wrote:
> ucsi_acpi_probe() dereferences the ACPI companion device pointer
> returned by ACPI_COMPANION() without checking it for NULL. While
> this driver is normally probed through ACPI device enumeration
> where a companion is always present, a platform_device can also be
> manually bound to any platform driver via the sysfs 'bind' file
> (bind_store() -> bus_find_device() -> driver_attach_device()),
> which matches purely on device name and bypasses ACPI matching.

Again, if someone does a manual bind, they get to keep the pieces that
break if something goes wrong.

I should just add a taint-flag to the kernel for this.  Well, maybe just
for unbind.  But really, don't do this on random drivers, bad things,
like this, can happen, and are in fact, guaranteed :)

thanks,

greg k-h