[v2] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[PATCH v2] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Deepanshu Kartikey 1 month, 2 weeks ago

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
v2: Drop Fixes tag, this isn't a regression from a single commit -
    the unconditional dereference of ->driver_data has always assumed
    it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption
    broken by the generic driver_override fallback path, not by any
    i915-specific change. Add Cc: stable instead. (Krzysztof, Jani)
---
 drivers/gpu/drm/i915/i915_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 82415af47d54..2f03f95945f1 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		(struct intel_device_info *) ent->driver_data;
 	int err;
 
+	if (!intel_info)
+		return -ENODEV;
+
 	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
 		dev_info(&pdev->dev,
 			 "Your graphics device %04x is not properly supported by i915 in this\n"
-- 
2.43.0

Re: [PATCH v2] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Deepanshu Kartikey 4 weeks, 1 day ago

On Thu, Aug 13, 2026 at 12:19 PM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> pci_match_device() can return the dummy pci_device_id_any entry
> when a device is force-bound via sysfs driver_override, in which
> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> struct intel_device_info * unconditionally and dereferences
> intel_info->require_force_probe, causing a NULL-ptr-deref.
>
> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> v2: Drop Fixes tag, this isn't a regression from a single commit -
>     the unconditional dereference of ->driver_data has always assumed
>     it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption
>     broken by the generic driver_override fallback path, not by any
>     i915-specific change. Add Cc: stable instead. (Krzysztof, Jani)
> ---
>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d54..2f03f95945f1 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>                 (struct intel_device_info *) ent->driver_data;
>         int err;
>
> +       if (!intel_info)
> +               return -ENODEV;
> +
>         if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>                 dev_info(&pdev->dev,
>                          "Your graphics device %04x is not properly supported by i915 in this\n"
> --
> 2.43.0
>

Gente Reminder. Let me know the status of this patch .

Thanks

Deepanshu

Re: [PATCH v2] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Jani Nikula 4 weeks ago

On Sun, 30 Aug 2026, Deepanshu Kartikey <kartikey406@gmail.com> wrote:
> On Thu, Aug 13, 2026 at 12:19 PM Deepanshu Kartikey
> <kartikey406@gmail.com> wrote:
>>
>> pci_match_device() can return the dummy pci_device_id_any entry
>> when a device is force-bound via sysfs driver_override, in which
>> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
>> struct intel_device_info * unconditionally and dereferences
>> intel_info->require_force_probe, causing a NULL-ptr-deref.
>>
>> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
>> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
>> ---
>> v2: Drop Fixes tag, this isn't a regression from a single commit -
>>     the unconditional dereference of ->driver_data has always assumed
>>     it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption
>>     broken by the generic driver_override fallback path, not by any
>>     i915-specific change. Add Cc: stable instead. (Krzysztof, Jani)
>> ---
>>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
>> index 82415af47d54..2f03f95945f1 100644
>> --- a/drivers/gpu/drm/i915/i915_pci.c
>> +++ b/drivers/gpu/drm/i915/i915_pci.c
>> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>>                 (struct intel_device_info *) ent->driver_data;
>>         int err;
>>
>> +       if (!intel_info)
>> +               return -ENODEV;
>> +
>>         if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>>                 dev_info(&pdev->dev,
>>                          "Your graphics device %04x is not properly supported by i915 in this\n"
>> --
>> 2.43.0
>>
>
> Gente Reminder. Let me know the status of this patch .

Sorry about the delay. Thanks for the patch, pushed to drm-intel-next.

BR,
Jani.

>
> Thanks
>
> Deepanshu

-- 
Jani Nikula, Intel

Re: [PATCH v2] drm/i915: Guard against NULL driver_data in i915_pci_probe()

Posted by Deepanshu Kartikey 1 month, 1 week ago

On Thu, Aug 13, 2026 at 12:19 PM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> pci_match_device() can return the dummy pci_device_id_any entry
> when a device is force-bound via sysfs driver_override, in which
> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> struct intel_device_info * unconditionally and dereferences
> intel_info->require_force_probe, causing a NULL-ptr-deref.
>
> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> v2: Drop Fixes tag, this isn't a regression from a single commit -
>     the unconditional dereference of ->driver_data has always assumed
>     it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption
>     broken by the generic driver_override fallback path, not by any
>     i915-specific change. Add Cc: stable instead. (Krzysztof, Jani)
> ---
>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d54..2f03f95945f1 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>                 (struct intel_device_info *) ent->driver_data;
>         int err;
>
> +       if (!intel_info)
> +               return -ENODEV;
> +
>         if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>                 dev_info(&pdev->dev,
>                          "Your graphics device %04x is not properly supported by i915 in this\n"
> --
> 2.43.0
>

Gente Reminder. Let me know the status of this patch .

Thanks

Deepanshu