[PATCH] Drivers: hv: vmbus: Fix potential NULL pointer dereference in vmbus_acpi_add()

[PATCH] Drivers: hv: vmbus: Fix potential NULL pointer dereference in vmbus_acpi_add()

[Ваторопин Андрей]

From: Andrey Vatoropin <a.vatoropin@crpt.ru>

The current driver supports detection via both the ACPI interface and the
Device Tree interface (OF).

In the function vmbus_platform_driver_probe() upon driver detection via OF,
the branch vmbus_device_add() should be executed.

However, the variable "acpi_disabled" is a global variable that, in general
equals 0 when CONFIG_ACPI is enabled. Therefore, it may enter another
branch with vmbus_acpi_add().

Therefore, in the function vmbus_acpi_add(), when the device is not ACPI,
the ACPI_COMPANION macro may return a NULL value, and this pointer is then
dereferenced.

Add a NULL pointer check for the "device" pointer before dereferencing it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: f83705a51275 ("Driver: VMBus: Add Devicetree support")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
---
 drivers/hv/vmbus_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index bc4fc1951ae1..c9ee3375b524 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -2571,6 +2571,9 @@ static int vmbus_acpi_add(struct platform_device *pdev)
 	struct acpi_device *ancestor;
 	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
 
+	if (!device)
+		return -ENODEV;
+
 	vmbus_root_device = &device->dev;
 
 	/*
-- 
2.43.0

Re: [PATCH] Drivers: hv: vmbus: Fix potential NULL pointer dereference in vmbus_acpi_add()

[Naman Jain]

On 3/10/2026 2:12 PM, Ваторопин Андрей wrote:
> From: Andrey Vatoropin <a.vatoropin@crpt.ru>
> 
> The current driver supports detection via both the ACPI interface and the
> Device Tree interface (OF).
> 
> In the function vmbus_platform_driver_probe() upon driver detection via OF,
> the branch vmbus_device_add() should be executed.
> 
> However, the variable "acpi_disabled" is a global variable that, in general
> equals 0 when CONFIG_ACPI is enabled. Therefore, it may enter another
> branch with vmbus_acpi_add().
> 
> Therefore, in the function vmbus_acpi_add(), when the device is not ACPI,
> the ACPI_COMPANION macro may return a NULL value, and this pointer is then
> dereferenced.
> 
> Add a NULL pointer check for the "device" pointer before dereferencing it.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: f83705a51275 ("Driver: VMBus: Add Devicetree support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
> ---
>   drivers/hv/vmbus_drv.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
> index bc4fc1951ae1..c9ee3375b524 100644
> --- a/drivers/hv/vmbus_drv.c
> +++ b/drivers/hv/vmbus_drv.c
> @@ -2571,6 +2571,9 @@ static int vmbus_acpi_add(struct platform_device *pdev)
>   	struct acpi_device *ancestor;
>   	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
>   
> +	if (!device)
> +		return -ENODEV;
> +
>   	vmbus_root_device = &device->dev;
>   
>   	/*

I understand the case we are trying to make here, but I tried 
reproducing this at my end, where we are probing VMBus using Devicetree, 
and CONFIG_ACPI is enabled and there is no "acpi=off" in kernel cmdline.
But still, when the control reaches this particular function - 
vmbus_platform_driver_probe(), acpi_disabled still shows up as 1 for me.
Can you please share your configuration how you are able to reproduce 
this issue.

Secondly, let's say this case happens, then while our fix prevents null 
pointer crash from happening, it does not fix the problem completely in 
the sense - vmbus_device_add() should still have been called in this 
scenario IMO. Please see if there is any way to do that, or comment, if 
you feel this issue won't be there.

Regards,
Naman