7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guangshuo Li [ Upstream commit 2b30842e52d9a364428b598f5edd4b12fa772f5a ] acpi_sbs_probe() jumps to the common error path when kzalloc_obj() fails, but platform_set_drvdata() is only called after the allocation succeeds. The error path calls acpi_sbs_remove(), which retrieves the unset driver data and dereferences the resulting NULL pointer when locking sbs->lock, causing a NULL pointer dereference. Return -ENOMEM directly when the allocation fails, since no resources have been initialized at that point and there is nothing to clean up. This issue was found by manual code inspection. Fixes: 9460eaae2ee42 ("ACPI: SBS: Convert the driver to a platform one") Cc: All applicable Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260912113355.644238-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/acpi/sbs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c index 86b7c79758526..4b84b3cd11e38 100644 --- a/drivers/acpi/sbs.c +++ b/drivers/acpi/sbs.c @@ -639,10 +639,8 @@ static int acpi_sbs_probe(struct platform_device *pdev) return -ENODEV; sbs = kzalloc_obj(struct acpi_sbs); - if (!sbs) { - result = -ENOMEM; - goto end; - } + if (!sbs) + return -ENOMEM; mutex_init(&sbs->lock); -- 2.53.0