[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Deepanshu Kartikey]

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/i915/i915_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 82415af47d54..2f03f95945f1 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		(struct intel_device_info *) ent->driver_data;
 	int err;
 
+	if (!intel_info)
+		return -ENODEV;
+
 	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
 		dev_info(&pdev->dev,
 			 "Your graphics device %04x is not properly supported by i915 in this\n"
-- 
2.43.0

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The exact same NULL-pointer dereference vulnerability fixed in `drm/i915` also exists in the sibling driver `drm/xe`.
--

--- Patch [1]: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe() ---
commit 88147f0f2fd48d4b9d650095dee423ce2e3c8939
Author: Deepanshu Kartikey <kartikey406@gmail.com>

drm/i915: Guard against NULL driver_data in i915_pci_probe()

This commit fixes a NULL pointer dereference in i915_pci_probe() when a
device is force-bound via sysfs driver_override, which results in a NULL
driver_data being returned by pci_match_device().

Link: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc

> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d540..2f03f95945f1b 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  		(struct intel_device_info *) ent->driver_data;
>  	int err;
>  
> +	if (!intel_info)
> +		return -ENODEV;

[Severity: High]
This is a pre-existing issue, but does the exact same vulnerability exist in
the sibling drm/xe driver?

When a device is force-bound via the sysfs driver_override interface,
xe_pci_probe() in drivers/gpu/drm/xe/xe_pci.c will also receive a dummy
entry where ent->driver_data is NULL. This is cast to desc and passed
directly to find_subplatform():

drivers/gpu/drm/xe/xe_pci.c:xe_pci_probe() {
    ...
    const struct xe_device_desc *desc = (const void *)ent->driver_data;
    ...
    subplatform_desc = find_subplatform(desc, pdev->device);
    ...
}

Inside find_subplatform(), this pointer is unconditionally dereferenced:

drivers/gpu/drm/xe/xe_pci.c:find_subplatform() {
    ...
    for (sp = desc->subplatforms; sp && sp->subplatform; sp++)
    ...
}

Should a similar guard be added to xe_pci_probe() to prevent a kernel
panic there as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260809090430.20577-1-kartikey406@gmail.com?part=1