platform/chrome: check ACPI companions before use

Two Chrome platform drivers assume their firmware-matched devices always carry an ACPI companion. Driver override can bind either driver to a device without one, leading probe to dereference a NULL companion.

Reject missing companions before passing them to ACPI resource and notify handler APIs. Each change is independent and preserves the normal firmware-matched probe path.

Jiale Yao (2):
platform/chrome: cros_ec_uart: check ACPI companion before use platform/chrome: cros_usbpd_notify: check ACPI companion

 drivers/platform/chrome/cros_ec_uart.c      | 8 ++++++--
 drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
 2 files changed, 8 insertions(+), 2 deletions(-)

2.34.1

cros_ec_uart_acpi_probe() passes the ACPI companion to resource helpers without checking it. A serdev force-bound without an ACPI companion can therefore cause a NULL pointer dereference during probe.

Reject devices without an ACPI companion before parsing their resources.

---
 drivers/platform/chrome/cros_ec_uart.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index d5b37414ff12..779aabd16674 100644
@@ -223,9 +223,13 @@ static int cros_ec_uart_resource(struct acpi_resource *ares, void *data)
 
 static int cros_ec_uart_acpi_probe(struct cros_ec_uart *ec_uart)
 {
-	int ret;
+	struct acpi_device *adev;
 	LIST_HEAD(resources);
-	struct acpi_device *adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+	int ret;
+
+	adev = ACPI_COMPANION(&ec_uart->serdev->dev);
+	if (!adev)
+		return -ENODEV;
 
 	ret = acpi_dev_get_resources(adev, &resources, cros_ec_uart_resource, ec_uart);
 	if (ret < 0)

2.34.1

The ACPI probe installs a notification handler through the device ACPI companion without checking that the companion exists. A force-bound platform device can therefore cause a NULL pointer dereference.

Return -ENODEV before allocating probe resources when the companion is missing.

---
 drivers/platform/chrome/cros_usbpd_notify.c | 2 ++
 1 file changed, 2 insertions(+)

index 25da31ec1996..1d82c74583cb 100644
@@ -105,6 +105,8 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev)
 	acpi_status status;
 
 	adev = ACPI_COMPANION(dev);
+	if (!adev)
+		return -ENODEV;
 
 	pdnotify = devm_kzalloc(dev, sizeof(*pdnotify), GFP_KERNEL);
 	if (!pdnotify)

2.34.1

I'll queue this after -rc1 comes out.

Applied to

https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[2/2] platform/chrome: cros_usbpd_notify: check ACPI companion

      commit: 87f74d2b224ae6484628500136a75677766ed52c

Thanks!