[PATCH 0/2] platform/surface: Check ACPI companion during probe

[PATCH 0/2] platform/surface: Check ACPI companion during probe

[Linmao Li]

Since every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override(),
platform drivers that rely on the existence of a device's ACPI companion
object should verify its presence.

Commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL
during probe") added such checks to the core ACPI platform drivers, but
two drivers under platform/surface dereference the result of
ACPI_COMPANION() in their probe functions without checking it, leading
to a NULL pointer dereference when force-bound to a device without an
ACPI companion.  Add the same checks there.

Linmao Li (2):
  platform/surface: acpi-notify: Check ACPI companion before use
  platform/surface: surfacepro3_button: Check ACPI companion before use

 drivers/platform/surface/surface_acpi_notify.c | 6 +++++-
 drivers/platform/surface/surfacepro3_button.c  | 9 +++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

-- 
2.25.1

[PATCH 1/2] platform/surface: acpi-notify: Check ACPI companion before use

[Linmao Li]

Since every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override(),
platform drivers that rely on the existence of a device's ACPI companion
object should verify its presence.

san_probe() dereferences the result of ACPI_COMPANION() when installing
the GSBUS address space handler, so force-binding the driver to a device
without an ACPI companion leads to a NULL pointer dereference.  The
dereference was introduced when the probe function was switched from
ACPI_HANDLE() to ACPI_COMPANION().

Check the ACPI companion against NULL and return -ENODEV when it is
missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION()
against NULL during probe") does for the core ACPI platform drivers.

Fixes: a9e10e587304 ("ACPI: scan: Extend acpi_walk_dep_device_list()")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/platform/surface/surface_acpi_notify.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/surface/surface_acpi_notify.c b/drivers/platform/surface/surface_acpi_notify.c
index a9dcb0bbe90e..593a7aba6243 100644
--- a/drivers/platform/surface/surface_acpi_notify.c
+++ b/drivers/platform/surface/surface_acpi_notify.c
@@ -777,12 +777,16 @@ static int san_consumer_links_setup(struct platform_device *pdev)
 
 static int san_probe(struct platform_device *pdev)
 {
-	struct acpi_device *san = ACPI_COMPANION(&pdev->dev);
 	struct ssam_controller *ctrl;
+	struct acpi_device *san;
 	struct san_data *data;
 	acpi_status astatus;
 	int status;
 
+	san = ACPI_COMPANION(&pdev->dev);
+	if (!san)
+		return -ENODEV;
+
 	ctrl = ssam_client_bind(&pdev->dev);
 	if (IS_ERR(ctrl))
 		return PTR_ERR(ctrl) == -ENODEV ? -EPROBE_DEFER : PTR_ERR(ctrl);
-- 
2.25.1

[PATCH 2/2] platform/surface: surfacepro3_button: Check ACPI companion before use

[Linmao Li]

Since every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override(),
platform drivers that rely on the existence of a device's ACPI companion
object should verify its presence.

surface_button_probe() passes the result of ACPI_COMPANION() to
acpi_device_hid(), which dereferences it, so force-binding the driver to
a device without an ACPI companion leads to a NULL pointer dereference.
The driver has been exposed to this since it was converted from an ACPI
driver to a platform driver.

Check the ACPI companion against NULL and return -ENODEV when it is
missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION()
against NULL during probe") does for the core ACPI platform drivers.

Fixes: d913a5a12b40 ("platform/surface: surfacepro3_button: Convert to a platform driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/platform/surface/surfacepro3_button.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/surface/surfacepro3_button.c b/drivers/platform/surface/surfacepro3_button.c
index 0293bc517b54..29a10e6c3a3f 100644
--- a/drivers/platform/surface/surfacepro3_button.c
+++ b/drivers/platform/surface/surfacepro3_button.c
@@ -185,12 +185,17 @@ static bool surface_button_check_MSHW0040(struct device *dev, acpi_handle handle
 
 static int surface_button_probe(struct platform_device *pdev)
 {
-	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
 	struct surface_button *button;
+	struct acpi_device *device;
 	struct input_dev *input;
-	const char *hid = acpi_device_hid(device);
+	const char *hid;
 	int error;
 
+	device = ACPI_COMPANION(&pdev->dev);
+	if (!device)
+		return -ENODEV;
+
+	hid = acpi_device_hid(device);
 	if (strncmp(acpi_device_bid(device), SURFACE_BUTTON_OBJ_NAME,
 	    strlen(SURFACE_BUTTON_OBJ_NAME)))
 		return -ENODEV;
-- 
2.25.1

Re: [PATCH 2/2] platform/surface: surfacepro3_button: Check ACPI companion before use

[Linmao Li]

Please drop this patch.

Rafael already posted the same fix in May and it has been accepted:

https://patchwork.kernel.org/project/platform-driver-x86/patch/23119222.EfDdHjke4D@rafael.j.wysocki/

Patch 1/2 of this series is independent of this one and still applies.
Sorry for the noise.

Re: [PATCH 0/2] platform/surface: Check ACPI companion during probe

[Ilpo Järvinen]

On Mon, 06 Jul 2026 09:25:10 +0800, Linmao Li wrote:

> Since every platform driver can be forced to match a device that doesn't
> match its list of device IDs because of device_match_driver_override(),
> platform drivers that rely on the existence of a device's ACPI companion
> object should verify its presence.
> 
> Commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL
> during probe") added such checks to the core ACPI platform drivers, but
> two drivers under platform/surface dereference the result of
> ACPI_COMPANION() in their probe functions without checking it, leading
> to a NULL pointer dereference when force-bound to a device without an
> ACPI companion.  Add the same checks there.
> 
> [...]

Thank you for your contribution, it has been applied to my local
review-ilpo-next branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-next branch only once I've pushed my
local branch there, which might take a while.

FYI [if applicable to your patch], as per Linus' policy change, also
fixes are mostly routed through for-next unless the fix is for a
commit introduced in the most recent cycle or is clearly a regression
fix.

The list of commits applied:
[1/2] platform/surface: acpi-notify: Check ACPI companion before use
      commit: 2b3a5dabe89e330413af403246b648c1890f368f
[2/2] platform/surface: surfacepro3_button: Check ACPI companion before use
      (no commit info)

--
 i.