From: By <xiaobai050@gmail.com>
To: agk@redhat.com
Cc: snitzer@kernel.org, mpatocka@redhat.com, bmarzins@redhat.com,
dm-devel@lists.linux.dev, linux-kernel@vger.kernel.org,
syzbot+bdff1ecf726d2af66afd@syzkaller.appspotmail.com,
By <xiaobai050@gmail.com>,
syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com
Subject: [PATCH] usb: dwc3: pci: reject matches without software-node data
Date: Wed, 23 Sep 2026 16:10:21 +0800 [thread overview]
Message-ID: <20260923081021.89508-1-xiaobai050@gmail.com> (raw)
A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
passes NULL to device_add_software_node(), which crashes in
software_node_register().
Reject the match before enabling the device or allocating resources.
All static DWC3 PCI IDs provide software-node data.
Build-tested with ARCH=arm64 defconfig and dwc3-pci.o. The runtime
reproducer could not be run in this environment.
Fixes: e492ce9bcaa1 ("usb: dwc3: pci: Register a software node for the dwc3 platform device")
Reported-by: syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=665bae0a102933788e1a
Assisted-by: LLM
Signed-off-by: By <xiaobai050@gmail.com>
---
drivers/usb/dwc3/dwc3-pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 6c1cbb722..d7fdf6ca6 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -335,6 +335,9 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
int ret;
struct device *dev = &pci->dev;
+ if (!id->driver_data)
+ return -ENODEV;
+
ret = pcim_enable_device(pci);
if (ret) {
dev_err(dev, "failed to enable pci device\n");
--
2.55.0
next reply other threads:[~2026-09-23 8:10 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-23 8:10 By [this message]
2026-09-23 18:52 ` Benjamin Marzinski
-- strict thread matches above, loose matches on Subject: below --
2026-09-23 8:10 By
2026-09-23 9:24 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260923081021.89508-1-xiaobai050@gmail.com \
--to=xiaobai050@gmail.com \
--cc=agk@redhat.com \
--cc=bmarzins@redhat.com \
--cc=dm-devel@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=snitzer@kernel.org \
--cc=syzbot+665bae0a102933788e1a@syzkaller.appspotmail.com \
--cc=syzbot+bdff1ecf726d2af66afd@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®