From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA5B2432E7C for ; Tue, 11 Aug 2026 09:31:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.17 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786440709; cv=none; b=mtMyHOxi7tkIa/MNkDX1NrNpRZyn+JaGQDl9kZcucnyY2H8LPIM/n/hPtqG07K/G0mhF4vFzr9i0gcvwqlwHCetEWsSkTUzILW+EZOTlk3GthhcoksJwMphGHp138r7fz4zCzGhpde17iGeMS+fGaEOeZ6Sar1ljecswGa1yszk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786440709; c=relaxed/simple; bh=VqO9snPY1kO7ANxAZxt5rrsRvBARfe7y+xHpx2h2ci4=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=KLntwtcQlr5zsn+HrBaG3vd1R1pas8ORYCB4s3TfQGNcqpjLoVusYvJbpVmLVi5thQIm3d44/QT94kwxiNkhl9jR/eN0R29T3aQws+eiq0lM3d6guavG8szyp9/illFKP7F43qdoBkkEDrV2KjlWMnFOirH1HL2LPINHQUeftF0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=QlYutJFd; arc=none smtp.client-ip=198.175.65.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="QlYutJFd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1786440706; x=1817976706; h=from:to:cc:subject:in-reply-to:references:date: message-id:mime-version; bh=VqO9snPY1kO7ANxAZxt5rrsRvBARfe7y+xHpx2h2ci4=; b=QlYutJFdk5sgj/JSB1yWCrd5iqJvtmbYh+VziV6XG6rlpqq/ZbDPvY7F qvt8fXl55piGseZO6L0RANyHbCCjAniaT/3vhqm/vcJcyvoJe0iQcWhWC OlvpYsYkgISftzVau8Jp1OS8/HB//FIxvArXdvc3j+7D2YVsNIRFCalla gMvlCE7Pd+KuYasqe7dQDwREGhgZ3huJ92BTjQGvb0cRiYTSjayogR0o3 ZK9BdjsRbw4KukBPxEnQgePRbPFMttQyjtmSVu0AHtS4uIct8kec26y29 O4GHQh6JDkf2nn7LXPZ2DypQzLMgAgbCOHEfSNQILR6jY+9L2OOetWRdH g==; X-CSE-ConnectionGUID: DC4qG6RtQ0W8ZUtAemCNrg== X-CSE-MsgGUID: S3MVo05QQN66iQSBMytPeQ== X-IronPort-AV: E=McAfee;i="6800,10657,11871"; a="86978943" X-IronPort-AV: E=Sophos;i="6.25,217,1779174000"; d="scan'208";a="86978943" Received: from orviesa003.jf.intel.com ([10.64.159.143]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Aug 2026 02:31:45 -0700 X-CSE-ConnectionGUID: 1/Aid0EDS0iIQg7RbjOdFw== X-CSE-MsgGUID: /wEw9L/KSzKGKoltvUUvsQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,217,1779174000"; d="scan'208";a="266774530" Received: from abityuts-desk.ger.corp.intel.com (HELO localhost) ([10.245.244.254]) by ORVIESA003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Aug 2026 02:31:41 -0700 From: Jani Nikula To: Krzysztof Karas , Deepanshu Kartikey Cc: joonas.lahtinen@linux.intel.com, rodrigo.vivi@intel.com, tursulin@ursulin.net, airlied@gmail.com, simona@ffwll.ch, chris@chris-wilson.co.uk, intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com Subject: Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe() In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland References: <20260809090430.20577-1-kartikey406@gmail.com> Date: Tue, 11 Aug 2026 12:31:37 +0300 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On Tue, 11 Aug 2026, Krzysztof Karas wrote: > Hi Deepanshu, > > On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote: >> pci_match_device() can return the dummy pci_device_id_any entry >> when a device is force-bound via sysfs driver_override, in which >> case ->driver_data is unset (NULL). i915_pci_probe() casts it to >> struct intel_device_info * unconditionally and dereferences >> intel_info->require_force_probe, causing a NULL-ptr-deref. >> >> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc >> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com >> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c") > This "Fixes" tag should point to the commit that breaks stuff, In general, agreed... > I believe, so what you are looking for is > 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support") > since this patch introduced that unconditional dereference. ...but that didn't introduce the unconditional reference. I think it was always there. We've always expected .driver_data to point at whatever we have specified in MODULE_DEVICE_TABLE(). I'd just slap a Cc: stable on it without Fixes. BR, Jani. > >> Signed-off-by: Deepanshu Kartikey >> --- >> drivers/gpu/drm/i915/i915_pci.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c >> index 82415af47d54..2f03f95945f1 100644 >> --- a/drivers/gpu/drm/i915/i915_pci.c >> +++ b/drivers/gpu/drm/i915/i915_pci.c >> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) >> (struct intel_device_info *) ent->driver_data; >> int err; >> >> + if (!intel_info) >> + return -ENODEV; >> + >> if (intel_info->require_force_probe && !id_forced(pdev->device)) { >> dev_info(&pdev->dev, >> "Your graphics device %04x is not properly supported by i915 in this\n" >> -- >> 2.43.0 >> -- Jani Nikula, Intel