[PATCH v1] platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

[PATCH v1] platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

[Mingyou Chen]

The driver registers two distinct WMI devices: a control device
(BITLAND_WMI_CONTROL) and an event device (BITLAND_WMI_EVENT). During
the probe phase, the event device handling path returns early before
initializing the platform profile device (data->pp_dev), leaving it
NULL.

However, the PM sleep operations are registered globally for the WMI
driver
and are triggered for both devices. When entering suspend, the event
device
invokes bitland_mifs_wmi_suspend(), which passes the uninitialized
data->pp_dev (NULL) into laptop_profile_get(). This leads to a NULL
pointer
dereference inside dev_get_drvdata(), causing a kernel Oops and halting
the
suspend sequence.

Fix this by adding a validity check for data->pp_dev in both the suspend
and resume callbacks, safely skipping profile operations for the event
device.

Signed-off-by: Mingyou Chen <qby140326@gmail.com>
---
 drivers/platform/x86/bitland-mifs-wmi.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/platform/x86/bitland-mifs-wmi.c b/drivers/platform/x86/bitland-mifs-wmi.c
index b0d06a80e89e..3a373184519d 100644
--- a/drivers/platform/x86/bitland-mifs-wmi.c
+++ b/drivers/platform/x86/bitland-mifs-wmi.c
@@ -300,6 +300,10 @@ static int bitland_mifs_wmi_suspend(struct device *dev)
 	enum platform_profile_option profile;
 	int ret;
 
+	/* Skip event device */
+	if (!data->pp_dev)
+		return 0;
+
 	ret = laptop_profile_get(data->pp_dev, &profile);
 	if (ret == 0)
 		data->saved_profile = profile;
@@ -311,6 +315,10 @@ static int bitland_mifs_wmi_resume(struct device *dev)
 {
 	struct bitland_mifs_wmi_data *data = dev_get_drvdata(dev);
 
+	/* Skip event device */
+	if (!data->pp_dev)
+		return 0;
+
 	dev_dbg(dev, "Resuming, restoring profile %d\n", data->saved_profile);
 	return laptop_profile_set(dev, data->saved_profile);
 }

base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
-- 
2.54.0

Re: [PATCH v1] platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

[Armin Wolf]

Am 20.06.26 um 10:18 schrieb Mingyou Chen:

> The driver registers two distinct WMI devices: a control device
> (BITLAND_WMI_CONTROL) and an event device (BITLAND_WMI_EVENT). During
> the probe phase, the event device handling path returns early before
> initializing the platform profile device (data->pp_dev), leaving it
> NULL.
>
> However, the PM sleep operations are registered globally for the WMI
> driver
> and are triggered for both devices. When entering suspend, the event
> device
> invokes bitland_mifs_wmi_suspend(), which passes the uninitialized
> data->pp_dev (NULL) into laptop_profile_get(). This leads to a NULL
> pointer
> dereference inside dev_get_drvdata(), causing a kernel Oops and halting
> the
> suspend sequence.
>
> Fix this by adding a validity check for data->pp_dev in both the suspend
> and resume callbacks, safely skipping profile operations for the event
> device.

Hi,

very good catch, i totally missed this during the initial review xd.

Reviewed-by: Armin Wolf <W_Armin@gmx.de>

>
> Signed-off-by: Mingyou Chen <qby140326@gmail.com>
> ---
>   drivers/platform/x86/bitland-mifs-wmi.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/drivers/platform/x86/bitland-mifs-wmi.c b/drivers/platform/x86/bitland-mifs-wmi.c
> index b0d06a80e89e..3a373184519d 100644
> --- a/drivers/platform/x86/bitland-mifs-wmi.c
> +++ b/drivers/platform/x86/bitland-mifs-wmi.c
> @@ -300,6 +300,10 @@ static int bitland_mifs_wmi_suspend(struct device *dev)
>   	enum platform_profile_option profile;
>   	int ret;
>   
> +	/* Skip event device */
> +	if (!data->pp_dev)
> +		return 0;
> +
>   	ret = laptop_profile_get(data->pp_dev, &profile);
>   	if (ret == 0)
>   		data->saved_profile = profile;
> @@ -311,6 +315,10 @@ static int bitland_mifs_wmi_resume(struct device *dev)
>   {
>   	struct bitland_mifs_wmi_data *data = dev_get_drvdata(dev);
>   
> +	/* Skip event device */
> +	if (!data->pp_dev)
> +		return 0;
> +
>   	dev_dbg(dev, "Resuming, restoring profile %d\n", data->saved_profile);
>   	return laptop_profile_set(dev, data->saved_profile);
>   }
>
> base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1

Re: [PATCH v1] platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

[Ilpo Järvinen]

On Sat, 20 Jun 2026, Mingyou Chen wrote:

> The driver registers two distinct WMI devices: a control device
> (BITLAND_WMI_CONTROL) and an event device (BITLAND_WMI_EVENT). During
> the probe phase, the event device handling path returns early before
> initializing the platform profile device (data->pp_dev), leaving it
> NULL.
> 
> However, the PM sleep operations are registered globally for the WMI
> driver
> and are triggered for both devices. When entering suspend, the event
> device
> invokes bitland_mifs_wmi_suspend(), which passes the uninitialized
> data->pp_dev (NULL) into laptop_profile_get(). This leads to a NULL
> pointer
> dereference inside dev_get_drvdata(), causing a kernel Oops and halting
> the
> suspend sequence.
> 
> Fix this by adding a validity check for data->pp_dev in both the suspend
> and resume callbacks, safely skipping profile operations for the event
> device.
> 
> Signed-off-by: Mingyou Chen <qby140326@gmail.com>

This seems to be missing a Fixes tag?

> ---
>  drivers/platform/x86/bitland-mifs-wmi.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/platform/x86/bitland-mifs-wmi.c b/drivers/platform/x86/bitland-mifs-wmi.c
> index b0d06a80e89e..3a373184519d 100644
> --- a/drivers/platform/x86/bitland-mifs-wmi.c
> +++ b/drivers/platform/x86/bitland-mifs-wmi.c
> @@ -300,6 +300,10 @@ static int bitland_mifs_wmi_suspend(struct device *dev)
>  	enum platform_profile_option profile;
>  	int ret;
>  
> +	/* Skip event device */
> +	if (!data->pp_dev)
> +		return 0;
> +
>  	ret = laptop_profile_get(data->pp_dev, &profile);
>  	if (ret == 0)
>  		data->saved_profile = profile;
> @@ -311,6 +315,10 @@ static int bitland_mifs_wmi_resume(struct device *dev)
>  {
>  	struct bitland_mifs_wmi_data *data = dev_get_drvdata(dev);
>  
> +	/* Skip event device */
> +	if (!data->pp_dev)
> +		return 0;
> +
>  	dev_dbg(dev, "Resuming, restoring profile %d\n", data->saved_profile);
>  	return laptop_profile_set(dev, data->saved_profile);
>  }
> 
> base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
> 

-- 
 i.