For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: typec: ucsi_acpi: fix NULL pointer dereference in ucsi_acpi_probe()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
ucsi_acpi_probe() dereferences the ACPI companion device pointer
returned by ACPI_COMPANION() without checking it for NULL. While
this driver is normally probed through ACPI device enumeration
where a companion is always present, a platform_device can also be
manually bound to any platform driver via the sysfs 'bind' file
(bind_store() -> bus_find_device() -> driver_attach_device()),
which matches purely on device name and bypasses ACPI matching.
If ucsi_acpi is bound this way to a platform device with no ACPI
companion, ACPI_COMPANION() returns NULL and the subsequent
adev->dep_unmet access dereferences a NULL pointer, resulting in a
general protection fault.
Add a NULL check for adev immediately after it is obtained and
before any resource allocation, returning -ENODEV to decline
binding cleanly.
Reported-by: syzbot+23cf45a9fce78e4e0dc1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=23cf45a9fce78e4e0dc1
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/usb/typec/ucsi/ucsi_acpi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
index 18286d3e9cc5..9fe4ba43afea 100644
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -196,6 +196,9 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
acpi_status status;
int ret;
+ if (!adev)
+ return -ENODEV;
+
if (adev->dep_unmet)
return -EPROBE_DEFER;
--
2.34.1