Re: [PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Aug 21, 2026 at 05:49:09PM +0530, Deepanshu Kartikey wrote:
> ucsi_acpi_probe() dereferences the ACPI companion device pointer
> returned by ACPI_COMPANION() without checking it for NULL. While
> this driver is normally probed through ACPI device enumeration
> where a companion is always present, a platform_device can also be
> manually bound to any platform driver via the sysfs 'bind' file
> (bind_store() -> bus_find_device() -> driver_attach_device()),
> which matches purely on device name and bypasses ACPI matching.

Again, if someone does a manual bind, they get to keep the pieces that
break if something goes wrong.

I should just add a taint-flag to the kernel for this.  Well, maybe just
for unbind.  But really, don't do this on random drivers, bad things,
like this, can happen, and are in fact, guaranteed :)

thanks,

greg k-h