Forwarded: [PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()

[syzbot <syzbot+23cf45a9fce78e4e0dc1@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


ucsi_acpi_probe() dereferences the ACPI companion device pointer
returned by ACPI_COMPANION() without checking it for NULL. While
this driver is normally probed through ACPI device enumeration
where a companion is always present, a platform_device can also be
manually bound to any platform driver via the sysfs 'bind' file
(bind_store() -> bus_find_device() -> driver_attach_device()),
which matches purely on device name and bypasses ACPI matching.

If ucsi_acpi is bound this way to a platform device with no ACPI
companion, ACPI_COMPANION() returns NULL and the subsequent
adev->dep_unmet access dereferences a NULL pointer, resulting in a
general protection fault.

Add a NULL check for adev immediately after it is obtained and
before any resource allocation, returning -ENODEV to decline
binding cleanly.

Reported-by: syzbot+23cf45a9fce78e4e0dc1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23cf45a9fce78e4e0dc1
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/usb/typec/ucsi/ucsi_acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
index 18286d3e9cc5..9fe4ba43afea 100644
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -196,6 +196,9 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
 	acpi_status status;
 	int ret;
 
+	if (!adev)
+		return -ENODEV;
+
 	if (adev->dep_unmet)
 		return -EPROBE_DEFER;
 
-- 
2.34.1