device_get_match_data() can return NULL, e.g. when the device is matched
through the I2C device ID table rather than the OF match table. The
returned value is stored in par->device_info and later dereferenced when
initializing par->vcomh, causing a NULL pointer dereference.

Check the return value right after the assignment and bail out with
-ENODEV (releasing the already allocated framebuffer) before any
dereference.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index c4fdecafd856..4d185c754284 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)
     spin_lock_init(&par->damage_lock);
 
     par->device_info = device_get_match_data(dev);
+    if (!par->device_info) {
+        ret = -ENODEV;
+        goto fb_alloc_error;
+    }
 
     par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
     if (IS_ERR(par->reset)) {

On 8/25/26 10:58, Yang Zi wrote:
> device_get_match_data() can return NULL, e.g. when the device is matched
> through the I2C device ID table rather than the OF match table. The
> returned value is stored in par->device_info and later dereferenced when
> initializing par->vcomh, causing a NULL pointer dereference.
> 
> Check the return value right after the assignment and bail out with
> -ENODEV (releasing the already allocated framebuffer) before any
> dereference.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>

The patch did not apply cleanly. I fixed it up manually and applied it.

Thanks!
Helge

> ---
> diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
> index c4fdecafd856..4d185c754284 100644
> --- a/drivers/video/fbdev/ssd1307fb.c
> +++ b/drivers/video/fbdev/ssd1307fb.c
> @@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)
>       spin_lock_init(&par->damage_lock);
>   
>       par->device_info = device_get_match_data(dev);
> +    if (!par->device_info) {
> +        ret = -ENODEV;
> +        goto fb_alloc_error;
> +    }
>   
>       par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
>       if (IS_ERR(par->reset)) {
>