Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()
Jani Nikula <[email protected]>
| Newsgroups | org.freedesktop.lists.intel-gfx,org.freedesktop.lists.dri-devel,org.kernel.vger.linux-kernel |
|---|---|
| Organization | Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland |
| Message-ID | <[email protected]> |
On Tue, 11 Aug 2026, Krzysztof Karas <[email protected]> wrote: > Hi Deepanshu, > > On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote: >> pci_match_device() can return the dummy pci_device_id_any entry >> when a device is force-bound via sysfs driver_override, in which >> case ->driver_data is unset (NULL). i915_pci_probe() casts it to >> struct intel_device_info * unconditionally and dereferences >> intel_info->require_force_probe, causing a NULL-ptr-deref. >> >> Reported-by: [email protected] >> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc >> Tested-by: [email protected] >> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c") > This "Fixes" tag should point to the commit that breaks stuff, In general, agreed... > I believe, so what you are looking for is > 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support") > since this patch introduced that unconditional dereference. ...but that didn't introduce the unconditional reference. I think it was always there. We've always expected .driver_data to point at whatever we have specified in MODULE_DEVICE_TABLE(). I'd just slap a Cc: stable on it without Fixes. BR, Jani. > >> Signed-off-by: Deepanshu Kartikey <[email protected]> >> --- >> drivers/gpu/drm/i915/i915_pci.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c >> index 82415af47d54..2f03f95945f1 100644 >> --- a/drivers/gpu/drm/i915/i915_pci.c >> +++ b/drivers/gpu/drm/i915/i915_pci.c >> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) >> (struct intel_device_info *) ent->driver_data; >> int err; >> >> + if (!intel_info) >> + return -ENODEV; >> + >> if (intel_info->require_force_probe && !id_forced(pdev->device)) { >> dev_info(&pdev->dev, >> "Your graphics device %04x is not properly supported by i915 in this\n" >> -- >> 2.43.0 >> -- Jani Nikula, Intel