[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Deepanshu Kartikey]

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/i915/i915_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 82415af47d54..2f03f95945f1 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		(struct intel_device_info *) ent->driver_data;
 	int err;
 
+	if (!intel_info)
+		return -ENODEV;
+
 	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
 		dev_info(&pdev->dev,
 			 "Your graphics device %04x is not properly supported by i915 in this\n"
-- 
2.43.0

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The exact same NULL-pointer dereference vulnerability fixed in `drm/i915` also exists in the sibling driver `drm/xe`.
--

--- Patch [1]: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe() ---
commit 88147f0f2fd48d4b9d650095dee423ce2e3c8939
Author: Deepanshu Kartikey <kartikey406@gmail.com>

drm/i915: Guard against NULL driver_data in i915_pci_probe()

This commit fixes a NULL pointer dereference in i915_pci_probe() when a
device is force-bound via sysfs driver_override, which results in a NULL
driver_data being returned by pci_match_device().

Link: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc

> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d540..2f03f95945f1b 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  		(struct intel_device_info *) ent->driver_data;
>  	int err;
>  
> +	if (!intel_info)
> +		return -ENODEV;

[Severity: High]
This is a pre-existing issue, but does the exact same vulnerability exist in
the sibling drm/xe driver?

When a device is force-bound via the sysfs driver_override interface,
xe_pci_probe() in drivers/gpu/drm/xe/xe_pci.c will also receive a dummy
entry where ent->driver_data is NULL. This is cast to desc and passed
directly to find_subplatform():

drivers/gpu/drm/xe/xe_pci.c:xe_pci_probe() {
    ...
    const struct xe_device_desc *desc = (const void *)ent->driver_data;
    ...
    subplatform_desc = find_subplatform(desc, pdev->device);
    ...
}

Inside find_subplatform(), this pointer is unconditionally dereferenced:

drivers/gpu/drm/xe/xe_pci.c:find_subplatform() {
    ...
    for (sp = desc->subplatforms; sp && sp->subplatform; sp++)
    ...
}

Should a similar guard be added to xe_pci_probe() to prevent a kernel
panic there as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260809090430.20577-1-kartikey406@gmail.com?part=1

✗ LGCI.VerificationFailed: failure for drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Patchwork]

== Series Details ==

Series: drm/i915: Guard against NULL driver_data in i915_pci_probe()
URL   : https://patchwork.freedesktop.org/series/171944/
State : failure

== Summary ==

Series author address 'kartikey406@gmail.com' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://gfx-ci.igk.intel.com:8080/job/CI_PW_kernel/183932/ (on built-in)

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Krzysztof Karas]

Hi Deepanshu,

On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
> pci_match_device() can return the dummy pci_device_id_any entry
> when a device is force-bound via sysfs driver_override, in which
> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> struct intel_device_info * unconditionally and dereferences
> intel_info->require_force_probe, causing a NULL-ptr-deref.
> 
> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
This "Fixes" tag should point to the commit that breaks stuff,
I believe, so what you are looking for is
7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
since this patch introduced that unconditional dereference.

> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d54..2f03f95945f1 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  		(struct intel_device_info *) ent->driver_data;
>  	int err;
>  
> +	if (!intel_info)
> +		return -ENODEV;
> +
>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>  		dev_info(&pdev->dev,
>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
> -- 
> 2.43.0
> 

-- 
Best Regards,
Krzysztof

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Jani Nikula]

On Tue, 11 Aug 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> Hi Deepanshu,
>
> On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
>> pci_match_device() can return the dummy pci_device_id_any entry
>> when a device is force-bound via sysfs driver_override, in which
>> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
>> struct intel_device_info * unconditionally and dereferences
>> intel_info->require_force_probe, causing a NULL-ptr-deref.
>> 
>> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
>> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
> This "Fixes" tag should point to the commit that breaks stuff,

In general, agreed...

> I believe, so what you are looking for is
> 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
> since this patch introduced that unconditional dereference.

...but that didn't introduce the unconditional reference. I think it was
always there. We've always expected .driver_data to point at whatever we
have specified in MODULE_DEVICE_TABLE().

I'd just slap a Cc: stable on it without Fixes.


BR,
Jani.

>
>> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
>> ---
>>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>>  1 file changed, 3 insertions(+)
>> 
>> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
>> index 82415af47d54..2f03f95945f1 100644
>> --- a/drivers/gpu/drm/i915/i915_pci.c
>> +++ b/drivers/gpu/drm/i915/i915_pci.c
>> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>>  		(struct intel_device_info *) ent->driver_data;
>>  	int err;
>>  
>> +	if (!intel_info)
>> +		return -ENODEV;
>> +
>>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>>  		dev_info(&pdev->dev,
>>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
>> -- 
>> 2.43.0
>> 

-- 
Jani Nikula, Intel