Re: [PATCH] cxl/acpi: Check ACPI companion before use

[Dave Jiang <dave.jiang@intel.com>]

On 9/24/26 5:54 AM, Jiale Yao wrote:
> Platform drivers can be forced to match devices outside their ID tables
> through driver_override.  cxl_acpi_probe() assumes that every bound device
> has an ACPI companion and dereferences adev->dev.bus without checking the
> result of ACPI_COMPANION().  Force-binding cxl_acpi to a platform device
> without a companion therefore causes a NULL pointer dereference.
> 
> This was reproduced by setting the driver override for the pcspkr platform
> device to cxl_acpi and binding it through sysfs:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000280
>   #PF: supervisor read access in kernel mode
>   RIP: cxl_acpi_probe+0xf4/0x220
>   Call Trace:
>    platform_probe+0x4d/0x80
>    really_probe+0x106/0x370
>    device_driver_attach+0x4c/0xa0
>    bind_store+0xd0/0x100
> 
> Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
> companion before use") fixed the same force-binding issue in another
> platform driver.  Check the companion before setting up the CXL root and
> return -ENODEV when it is absent.
> 
> Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/cxl/acpi.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
> index 3b818adbd38b..2b67138013a9 100644
> --- a/drivers/cxl/acpi.c
> +++ b/drivers/cxl/acpi.c
> @@ -893,6 +893,9 @@ static int cxl_acpi_probe(struct platform_device *pdev)
>  	struct acpi_device *adev = ACPI_COMPANION(host);

Can you move the assignment down to just before it checks the pointer? Please make sure to adjust the variable declaration to conform to reverse christmas tree layout when you do. thanks

DJ

>  	struct cxl_cfmws_context ctx;
>  
> +	if (!adev)
> +		return -ENODEV;
> +
>  	device_lock_set_class(&pdev->dev, &cxl_root_key);
>  	rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,
>  				      &pdev->dev);