[v1] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Deepanshu Kartikey 1 month, 3 weeks ago

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/i915/i915_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 82415af47d54..2f03f95945f1 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		(struct intel_device_info *) ent->driver_data;
 	int err;
 
+	if (!intel_info)
+		return -ENODEV;
+
 	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
 		dev_info(&pdev->dev,
 			 "Your graphics device %04x is not properly supported by i915 in this\n"
-- 
2.43.0

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Krzysztof Karas 1 month, 2 weeks ago

Hi Deepanshu,

On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
> pci_match_device() can return the dummy pci_device_id_any entry
> when a device is force-bound via sysfs driver_override, in which
> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> struct intel_device_info * unconditionally and dereferences
> intel_info->require_force_probe, causing a NULL-ptr-deref.
> 
> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
This "Fixes" tag should point to the commit that breaks stuff,
I believe, so what you are looking for is
7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
since this patch introduced that unconditional dereference.

> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d54..2f03f95945f1 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  		(struct intel_device_info *) ent->driver_data;
>  	int err;
>  
> +	if (!intel_info)
> +		return -ENODEV;
> +
>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>  		dev_info(&pdev->dev,
>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
> -- 
> 2.43.0
> 

-- 
Best Regards,
Krzysztof

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Jani Nikula 1 month, 2 weeks ago

On Tue, 11 Aug 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> Hi Deepanshu,
>
> On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
>> pci_match_device() can return the dummy pci_device_id_any entry
>> when a device is force-bound via sysfs driver_override, in which
>> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
>> struct intel_device_info * unconditionally and dereferences
>> intel_info->require_force_probe, causing a NULL-ptr-deref.
>> 
>> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
>> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
> This "Fixes" tag should point to the commit that breaks stuff,

In general, agreed...

> I believe, so what you are looking for is
> 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
> since this patch introduced that unconditional dereference.

...but that didn't introduce the unconditional reference. I think it was
always there. We've always expected .driver_data to point at whatever we
have specified in MODULE_DEVICE_TABLE().

I'd just slap a Cc: stable on it without Fixes.


BR,
Jani.

>
>> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
>> ---
>>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>>  1 file changed, 3 insertions(+)
>> 
>> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
>> index 82415af47d54..2f03f95945f1 100644
>> --- a/drivers/gpu/drm/i915/i915_pci.c
>> +++ b/drivers/gpu/drm/i915/i915_pci.c
>> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>>  		(struct intel_device_info *) ent->driver_data;
>>  	int err;
>>  
>> +	if (!intel_info)
>> +		return -ENODEV;
>> +
>>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>>  		dev_info(&pdev->dev,
>>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
>> -- 
>> 2.43.0
>> 

-- 
Jani Nikula, Intel

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Deepanshu Kartikey 1 month, 2 weeks ago

On Tue, Aug 11, 2026 at 3:01 PM Jani Nikula <jani.nikula@linux.intel.com> wrote:
>
> On Tue, 11 Aug 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> > Hi Deepanshu,
> >
> > On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
> >> pci_match_device() can return the dummy pci_device_id_any entry
> >> when a device is force-bound via sysfs driver_override, in which
> >> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> >> struct intel_device_info * unconditionally and dereferences
> >> intel_info->require_force_probe, causing a NULL-ptr-deref.
> >>
> >> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> >> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> >> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> >> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
> > This "Fixes" tag should point to the commit that breaks stuff,
>
> In general, agreed...
>
> > I believe, so what you are looking for is
> > 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
> > since this patch introduced that unconditional dereference.
>
> ...but that didn't introduce the unconditional reference. I think it was
> always there. We've always expected .driver_data to point at whatever we
> have specified in MODULE_DEVICE_TABLE().
>
> I'd just slap a Cc: stable on it without Fixes.
>
>
> BR,
> Jani.
>
> >
> >> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> >> ---
> >>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> >> index 82415af47d54..2f03f95945f1 100644
> >> --- a/drivers/gpu/drm/i915/i915_pci.c
> >> +++ b/drivers/gpu/drm/i915/i915_pci.c
> >> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> >>              (struct intel_device_info *) ent->driver_data;
> >>      int err;
> >>
> >> +    if (!intel_info)
> >> +            return -ENODEV;
> >> +
> >>      if (intel_info->require_force_probe && !id_forced(pdev->device)) {
> >>              dev_info(&pdev->dev,
> >>                       "Your graphics device %04x is not properly supported by i915 in this\n"
> >> --
> >> 2.43.0
> >>
>
> --
> Jani Nikula, Intel

Thanks for the review. I have sent patch v2.

Deepanshu