From nobody Tue Sep 29 02:33:47 2026 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 18FE836A008 for ; Thu, 13 Aug 2026 06:49:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786603755; cv=none; b=COK9Yox8HYSKhb+wE4BTMGluouHX90zKsQ4scXJK8S08rbOpKWN52CcJYCh7cdrqMzoyepbHAf8JW4W3oHCqKcbqNMvQ5Mz/RZ6pOzX6WXVgz/6SceEy6fPAgTccOgclRAOkOgaM07EpizsHV2CEPEoUsYYXPdA9NqnLfwReOfk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786603755; c=relaxed/simple; bh=IeM1daAIpfu6fABLMg3PEU0F1GEGvpEr8JNujtFyz5I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VJtMSAREaPOXztEhQMk/0COMzwq+bXm7akZhEFOLKQ1J4VDTxmGNagmqAog3+DgxzwGNTGm8N6F8FTnkWrqSziT+kFh37Llhv4UIOz4MjQbl2uJRmJmSswM0uJqWqEI7P9k7bMtjEWB1cGwHhQ5QYlJqz+qH14bR3fNYmWeaYvc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e1CImrHN; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e1CImrHN" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-38e347638adso534990a91.0 for ; Wed, 12 Aug 2026 23:49:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786603753; x=1787208553; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Sj4nAB5UJQSiK8q2P2qqPUYrLHWdF5UCEVGSdlXatDA=; b=e1CImrHNgmNAu5tQcxmGeBdVLUYzIQfkRGFgH99kuwv9vhqvGWjqSneg5NwsNR182p jGJJCNpCgGt1Pe1twOsA+GY2BrD4Ct9S1K/NSZSz0xyE3BRgkpn5Vv553qpGi5ZT9F0w 4CnYtTekRhvt0FumeSEhf9jdKhRzlufhMvC/krYeLhj7YoTSEhgcKcjzj41YT+Q413bV yvobqd70FXDosPzkIxn8pTDmD72bz343iOsTYd2iKfXcI5ebP29rOFg2AVpssh1SBTVm 2uhgpz3tbdBh0ULjBxvL41b0SSUtCz41cn/w+P0oAOrtXVMiWzd7KJCo31GMlSrgJHX6 wfZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786603753; x=1787208553; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Sj4nAB5UJQSiK8q2P2qqPUYrLHWdF5UCEVGSdlXatDA=; b=BtI4OQH52pnNiOd+Gsh3/tL2JUrBlTE8QvnOthAZU+LdfPFZqK/CF5LmtMWcn3BX8G 4pYkvaJeRjkkYk/THT0ByRizNwtd5e1BKXmm2RZfi7BX1p0WaVMJDd90gn8PK85X3UbT WPLL+Q577Ycq4dZnKhTrhQVdOX7b3+ERAcOhXiUboqQPms4I/559c93ydONPt7bq/ezT 6R06X5LrsxrauNG0S0B1hyd4ElA6bj28nHETLsEzfRj+5dvZ5sarRP4ggm6gn6zl8CUV BrZhr8N+O8X6JOeGIjoPOcot+JCUBgB42L8jzpKrRl8CvM/bqctAwpdqg6LOBXSpvuCG JJeA== X-Forwarded-Encrypted: i=1; AHgh+RpWiXPkVcXx3yis6jjsZ4PYr+duZBg4Hf43a5S30A6XwMcSaY3jlORnVIFMGwkJTlCnH+DLaaG+gSenMSs=@vger.kernel.org X-Gm-Message-State: AOJu0YzIvgBQGlaenDN554UrCgTx2K51PfJXxd/vMKES/6opUozqccPY qm7lmacspmXwwCTLLnWOsaidUtlaRfwD4ppHAz0spPQVsVrpGs67YKoE X-Gm-Gg: AR+sD10XKEPap8ecAfD/YGn/PV+UE0WRNBqnVtuzpeQuW4S7bM56ynEYBlnztxJnQk2 uuC4B0v7SqIQuh6/ocBjubXV/jVp2QEhLVZ+2uDMBRe0FRsPwCQtb8a++P7MYldXWN+aGdtqWrd +a6jrbjxDZ8T4EhNQh5Kt0T2I+3fL+dpDBfIWxNL+rOIyz5IKeIq54Dmh7qvrBEhJqatCit/4do LAekIKjUcQEi2FXW7Nz2+Rz2gQR1R9SSCZGmERhJaU0k2R7QVtY5P0sNtxmWkPxEGGAV2+C/cGQ gMHKtxoJJAh/PzPbv2XBsuinBR1KQFJ0PTyBOBwh8AIHzd89IrL7gvLPtDCYH4ELd6OOc6ZyN7u wK05m8b150oHbrzSVj58qrleSGweP+3dsfNwPhcN47hbstBNlEi8QfoPBRmntISZqy5l2DahZkj KT/7p8lZfkydsvUDXlSstdSdlKa7cERno/rErmmDhDFYqp81tQMqDW78UImxaHPLaezz8IhsaoU gPWIwvKvii2lZp2Zd4igolXm965gsV68Z37NFRfsEo9fPMY0epYJATZtXIbmxhr X-Received: by 2002:a17:90b:1d43:b0:38e:3fdc:62e5 with SMTP id 98e67ed59e1d1-3931e2a0572mr4819755a91.19.1786603753033; Wed, 12 Aug 2026 23:49:13 -0700 (PDT) Received: from deepanshu-Legion-Pro-5-16AFR10.. ([2405:201:682f:383f:229c:e2c9:8c03:c9c1]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1412da6c0e0sm7111503c88.13.2026.08.12.23.49.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 23:49:12 -0700 (PDT) From: Deepanshu Kartikey To: jani.nikula@linux.intel.com, joonas.lahtinen@linux.intel.com, rodrigo.vivi@intel.com, tursulin@ursulin.net, airlied@gmail.com, simona@ffwll.ch, krzysztof.karas@intel.com Cc: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com, stable@vger.kernel.org Subject: [PATCH v2] drm/i915: Guard against NULL driver_data in i915_pci_probe() Date: Thu, 13 Aug 2026 12:19:02 +0530 Message-ID: <20260813064902.367504-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" pci_match_device() can return the dummy pci_device_id_any entry when a device is force-bound via sysfs driver_override, in which case ->driver_data is unset (NULL). i915_pci_probe() casts it to struct intel_device_info * unconditionally and dereferences intel_info->require_force_probe, causing a NULL-ptr-deref. Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Ddb96c5ff032f4292a8dc Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey --- v2: Drop Fixes tag, this isn't a regression from a single commit - the unconditional dereference of ->driver_data has always assumed it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption broken by the generic driver_override fallback path, not by any i915-specific change. Add Cc: stable instead. (Krzysztof, Jani) --- drivers/gpu/drm/i915/i915_pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pc= i.c index 82415af47d54..2f03f95945f1 100644 --- a/drivers/gpu/drm/i915/i915_pci.c +++ b/drivers/gpu/drm/i915/i915_pci.c @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const s= truct pci_device_id *ent) (struct intel_device_info *) ent->driver_data; int err; =20 + if (!intel_info) + return -ENODEV; + if (intel_info->require_force_probe && !id_forced(pdev->device)) { dev_info(&pdev->dev, "Your graphics device %04x is not properly supported by i915 in this\n" --=20 2.43.0