Add NULL check for ACPI_COMPANION() in parse_wdg() to prevent NULL
pointer dereference when driver_override matches a device without
ACPI companion.

Same issue as CVE-2026-64227.

Fixes: 4186a47dbfbc ("platform/x86: wmi: Decouple probe deferring from wmi_block_list")
Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn>
Cc: stable@vger.kernel.org
---
 drivers/platform/wmi/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c
index 529825dcfbfe..151b712d08b5 100644
--- a/drivers/platform/wmi/core.c
+++ b/drivers/platform/wmi/core.c
@@ -1290,7 +1290,7 @@ static int wmi_add_device(struct platform_device *pdev, struct wmi_device *wdev)
  */
 static int parse_wdg(struct device *wmi_bus_dev, struct platform_device *pdev)
 {
-	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
+	struct acpi_device *device;
 	struct acpi_buffer out = {ACPI_ALLOCATE_BUFFER, NULL};
 	const struct guid_block *gblock;
 	bool event_data_available;
@@ -1300,6 +1300,10 @@ static int parse_wdg(struct device *wmi_bus_dev, struct platform_device *pdev)
 	u32 i, total;
 	int retval;
 
+	device = ACPI_COMPANION(&pdev->dev);
+	if (!device)
+		return -ENODEV;
+
 	status = acpi_evaluate_object(device->handle, "_WDG", NULL, &out);
 	if (ACPI_FAILURE(status))
 		return -ENXIO;
-- 
2.43.0

Am 11.08.26 um 12:21 schrieb Xueqin Luo:

> Add NULL check for ACPI_COMPANION() in parse_wdg() to prevent NULL
> pointer dereference when driver_override matches a device without
> ACPI companion.
>
> Same issue as CVE-2026-64227.

Hi,

we already perform this check in acpi_wmi_probe(), so doing this again is
not necessary.

Thanks,
Armin Wolf

>
> Fixes: 4186a47dbfbc ("platform/x86: wmi: Decouple probe deferring from wmi_block_list")
> Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn>
> Cc: stable@vger.kernel.org
> ---
>   drivers/platform/wmi/core.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c
> index 529825dcfbfe..151b712d08b5 100644
> --- a/drivers/platform/wmi/core.c
> +++ b/drivers/platform/wmi/core.c
> @@ -1290,7 +1290,7 @@ static int wmi_add_device(struct platform_device *pdev, struct wmi_device *wdev)
>    */
>   static int parse_wdg(struct device *wmi_bus_dev, struct platform_device *pdev)
>   {
> -	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
> +	struct acpi_device *device;
>   	struct acpi_buffer out = {ACPI_ALLOCATE_BUFFER, NULL};
>   	const struct guid_block *gblock;
>   	bool event_data_available;
> @@ -1300,6 +1300,10 @@ static int parse_wdg(struct device *wmi_bus_dev, struct platform_device *pdev)
>   	u32 i, total;
>   	int retval;
>   
> +	device = ACPI_COMPANION(&pdev->dev);
> +	if (!device)
> +		return -ENODEV;
> +
>   	status = acpi_evaluate_object(device->handle, "_WDG", NULL, &out);
>   	if (ACPI_FAILURE(status))
>   		return -ENXIO;