[PATCH] cxl/acpi: Check ACPI companion before use

[PATCH] cxl/acpi: Check ACPI companion before use

[Jiale Yao]

Platform drivers can be forced to match devices outside their ID tables
through driver_override.  cxl_acpi_probe() assumes that every bound device
has an ACPI companion and dereferences adev->dev.bus without checking the
result of ACPI_COMPANION().  Force-binding cxl_acpi to a platform device
without a companion therefore causes a NULL pointer dereference.

This was reproduced by setting the driver override for the pcspkr platform
device to cxl_acpi and binding it through sysfs:

  BUG: kernel NULL pointer dereference, address: 0000000000000280
  #PF: supervisor read access in kernel mode
  RIP: cxl_acpi_probe+0xf4/0x220
  Call Trace:
   platform_probe+0x4d/0x80
   really_probe+0x106/0x370
   device_driver_attach+0x4c/0xa0
   bind_store+0xd0/0x100

Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
companion before use") fixed the same force-binding issue in another
platform driver.  Check the companion before setting up the CXL root and
return -ENODEV when it is absent.

Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/cxl/acpi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
index 3b818adbd38b..2b67138013a9 100644
--- a/drivers/cxl/acpi.c
+++ b/drivers/cxl/acpi.c
@@ -893,6 +893,9 @@ static int cxl_acpi_probe(struct platform_device *pdev)
 	struct acpi_device *adev = ACPI_COMPANION(host);
 	struct cxl_cfmws_context ctx;
 
+	if (!adev)
+		return -ENODEV;
+
 	device_lock_set_class(&pdev->dev, &cxl_root_key);
 	rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,
 				      &pdev->dev);
-- 
2.34.1

Re: [PATCH] cxl/acpi: Check ACPI companion before use

[Dave Jiang]

On 9/24/26 5:54 AM, Jiale Yao wrote:
> Platform drivers can be forced to match devices outside their ID tables
> through driver_override.  cxl_acpi_probe() assumes that every bound device
> has an ACPI companion and dereferences adev->dev.bus without checking the
> result of ACPI_COMPANION().  Force-binding cxl_acpi to a platform device
> without a companion therefore causes a NULL pointer dereference.
> 
> This was reproduced by setting the driver override for the pcspkr platform
> device to cxl_acpi and binding it through sysfs:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000280
>   #PF: supervisor read access in kernel mode
>   RIP: cxl_acpi_probe+0xf4/0x220
>   Call Trace:
>    platform_probe+0x4d/0x80
>    really_probe+0x106/0x370
>    device_driver_attach+0x4c/0xa0
>    bind_store+0xd0/0x100
> 
> Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
> companion before use") fixed the same force-binding issue in another
> platform driver.  Check the companion before setting up the CXL root and
> return -ENODEV when it is absent.
> 
> Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/cxl/acpi.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/cxl/acpi.c b/drivers/cxl/acpi.c
> index 3b818adbd38b..2b67138013a9 100644
> --- a/drivers/cxl/acpi.c
> +++ b/drivers/cxl/acpi.c
> @@ -893,6 +893,9 @@ static int cxl_acpi_probe(struct platform_device *pdev)
>  	struct acpi_device *adev = ACPI_COMPANION(host);

Can you move the assignment down to just before it checks the pointer? Please make sure to adjust the variable declaration to conform to reverse christmas tree layout when you do. thanks

DJ

>  	struct cxl_cfmws_context ctx;
>  
> +	if (!adev)
> +		return -ENODEV;
> +
>  	device_lock_set_class(&pdev->dev, &cxl_root_key);
>  	rc = devm_add_action_or_reset(&pdev->dev, cxl_acpi_lock_reset_class,
>  				      &pdev->dev);

Re: [PATCH] cxl/acpi: Check ACPI companion before use

[Davidlohr Bueso]

On Thu, 24 Sep 2026, Jiale Yao wrote:

>Platform drivers can be forced to match devices outside their ID tables
>through driver_override.  cxl_acpi_probe() assumes that every bound device
>has an ACPI companion and dereferences adev->dev.bus without checking the
>result of ACPI_COMPANION().  Force-binding cxl_acpi to a platform device
>without a companion therefore causes a NULL pointer dereference.
>
>This was reproduced by setting the driver override for the pcspkr platform
>device to cxl_acpi and binding it through sysfs:
>
>  BUG: kernel NULL pointer dereference, address: 0000000000000280
>  #PF: supervisor read access in kernel mode
>  RIP: cxl_acpi_probe+0xf4/0x220
>  Call Trace:
>   platform_probe+0x4d/0x80
>   really_probe+0x106/0x370
>   device_driver_attach+0x4c/0xa0
>   bind_store+0xd0/0x100
>
>Commit 2b3a5dabe89e ("platform/surface: acpi-notify: Check ACPI
>companion before use") fixed the same force-binding issue in another
>platform driver.  Check the companion before setting up the CXL root and
>return -ENODEV when it is absent.
>
>Fixes: 7d4b5ca2e2cb ("cxl/acpi: Add downstream port data to cxl_port instances")
>Cc: stable@vger.kernel.org
>Signed-off-by: Jiale Yao <yaojiale02@163.com>

With Dave's comment,

Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>