usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

[PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Joshua Crofts 1 month, 3 weeks ago

In stusb160x_probe(), the return value of i2c_get_match_data() is not
checked, causing a null pointer dereference later on if the device was
registered manually (without devicetree or ACPI).

Fix this by adding a NULL check for the return value of
i2c_get_match_data().

Reported-by: syzbot+6c7e68b141ebd3a2cadf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c7e68b141ebd3a2cadf
Fixes: 823754697556 ("usb: typec: stusb160x: Make use of i2c_get_match_data()")
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
 drivers/usb/typec/stusb160x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c
index 6d85b25b40bc..8f3435c669cd 100644
--- a/drivers/usb/typec/stusb160x.c
+++ b/drivers/usb/typec/stusb160x.c
@@ -645,6 +645,8 @@ static int stusb160x_probe(struct i2c_client *client)
 	i2c_set_clientdata(client, chip);
 
 	regmap_config = i2c_get_match_data(client);
+	if (!regmap_config)
+		return -ENODEV;
 
 	chip->regmap = devm_regmap_init_i2c(client, regmap_config);
 	if (IS_ERR(chip->regmap)) {
-- 
2.47.3

Re: [PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Joshua Crofts 1 month, 1 week ago

On Thu,  6 Aug 2026 08:43:01 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

> In stusb160x_probe(), the return value of i2c_get_match_data() is not
> checked, causing a null pointer dereference later on if the device was
> registered manually (without devicetree or ACPI).
> 
> Fix this by adding a NULL check for the return value of
> i2c_get_match_data().
> 
> Reported-by: syzbot+6c7e68b141ebd3a2cadf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6c7e68b141ebd3a2cadf
> Fixes: 823754697556 ("usb: typec: stusb160x: Make use of i2c_get_match_data()")
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
>  drivers/usb/typec/stusb160x.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c
> index 6d85b25b40bc..8f3435c669cd 100644
> --- a/drivers/usb/typec/stusb160x.c
> +++ b/drivers/usb/typec/stusb160x.c
> @@ -645,6 +645,8 @@ static int stusb160x_probe(struct i2c_client *client)
>  	i2c_set_clientdata(client, chip);
>  
>  	regmap_config = i2c_get_match_data(client);
> +	if (!regmap_config)
> +		return -ENODEV;
>  
>  	chip->regmap = devm_regmap_init_i2c(client, regmap_config);
>  	if (IS_ERR(chip->regmap)) {

Hi Greg and Heikki,

A (very) gentle ping on this patch. Do you need a v2 to include the
Cc to stable?

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Andy Shevchenko 1 month, 1 week ago

On Mon, Aug 24, 2026 at 08:40:41AM +0200, Joshua Crofts wrote:
> On Thu,  6 Aug 2026 08:43:01 +0000
> Joshua Crofts <joshua.crofts1@gmail.com> wrote:

...

> >  	regmap_config = i2c_get_match_data(client);
> > +	if (!regmap_config)
> > +		return -ENODEV;

Return -ENODATA here, it will distinguish better in case of debugging.

> A (very) gentle ping on this patch. Do you need a v2 to include the
> Cc to stable?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Joshua Crofts 1 month, 1 week ago

On Mon, 24 Aug 2026 09:48:26 +0300
Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:

> On Mon, Aug 24, 2026 at 08:40:41AM +0200, Joshua Crofts wrote:
> > On Thu,  6 Aug 2026 08:43:01 +0000
> > Joshua Crofts <joshua.crofts1@gmail.com> wrote:  
> 
> ...
> 
> > >  	regmap_config = i2c_get_match_data(client);
> > > +	if (!regmap_config)
> > > +		return -ENODEV;  
> 
> Return -ENODATA here, it will distinguish better in case of debugging.

Yep, this was before our discussion about this in IIO :)

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Greg Kroah-Hartman 1 month, 1 week ago

On Mon, Aug 24, 2026 at 08:40:41AM +0200, Joshua Crofts wrote:
> On Thu,  6 Aug 2026 08:43:01 +0000
> Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> 
> > In stusb160x_probe(), the return value of i2c_get_match_data() is not
> > checked, causing a null pointer dereference later on if the device was
> > registered manually (without devicetree or ACPI).
> > 
> > Fix this by adding a NULL check for the return value of
> > i2c_get_match_data().
> > 
> > Reported-by: syzbot+6c7e68b141ebd3a2cadf@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=6c7e68b141ebd3a2cadf
> > Fixes: 823754697556 ("usb: typec: stusb160x: Make use of i2c_get_match_data()")
> > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> > ---
> >  drivers/usb/typec/stusb160x.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/usb/typec/stusb160x.c b/drivers/usb/typec/stusb160x.c
> > index 6d85b25b40bc..8f3435c669cd 100644
> > --- a/drivers/usb/typec/stusb160x.c
> > +++ b/drivers/usb/typec/stusb160x.c
> > @@ -645,6 +645,8 @@ static int stusb160x_probe(struct i2c_client *client)
> >  	i2c_set_clientdata(client, chip);
> >  
> >  	regmap_config = i2c_get_match_data(client);
> > +	if (!regmap_config)
> > +		return -ENODEV;
> >  
> >  	chip->regmap = devm_regmap_init_i2c(client, regmap_config);
> >  	if (IS_ERR(chip->regmap)) {
> 
> Hi Greg and Heikki,
> 
> A (very) gentle ping on this patch. Do you need a v2 to include the

It's the middle of the merge window, we can't do anything until -rc1 is
out.

Also, this patch really isn't even needed, just don't attempt to bind
drivers to devices that are not the correct device.

thanks,

greg k-h

Re: [PATCH] usb: typec: stusb160x: add missing NULL check for i2c_get_match_data()

Posted by Joshua Crofts 1 month, 3 weeks ago

On Thu,  6 Aug 2026 08:43:01 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

> In stusb160x_probe(), the return value of i2c_get_match_data() is not
> checked, causing a null pointer dereference later on if the device was
> registered manually (without devicetree or ACPI).
> 
> Fix this by adding a NULL check for the return value of
> i2c_get_match_data().
> 
> Reported-by: syzbot+6c7e68b141ebd3a2cadf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6c7e68b141ebd3a2cadf
> Fixes: 823754697556 ("usb: typec: stusb160x: Make use of i2c_get_match_data()")
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---

Ugh, forgot to Cc stable.

-- 
Kind regards,
Joshua Crofts