[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Deepanshu Kartikey]

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/i915/i915_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index 82415af47d54..2f03f95945f1 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		(struct intel_device_info *) ent->driver_data;
 	int err;
 
+	if (!intel_info)
+		return -ENODEV;
+
 	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
 		dev_info(&pdev->dev,
 			 "Your graphics device %04x is not properly supported by i915 in this\n"
-- 
2.43.0

✗ LGCI.VerificationFailed: failure for drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Patchwork]

== Series Details ==

Series: drm/i915: Guard against NULL driver_data in i915_pci_probe()
URL   : https://patchwork.freedesktop.org/series/171944/
State : failure

== Summary ==

Series author address 'kartikey406@gmail.com' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://gfx-ci.igk.intel.com:8080/job/CI_PW_kernel/183932/ (on built-in)

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Krzysztof Karas]

Hi Deepanshu,

On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
> pci_match_device() can return the dummy pci_device_id_any entry
> when a device is force-bound via sysfs driver_override, in which
> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> struct intel_device_info * unconditionally and dereferences
> intel_info->require_force_probe, causing a NULL-ptr-deref.
> 
> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
This "Fixes" tag should point to the commit that breaks stuff,
I believe, so what you are looking for is
7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
since this patch introduced that unconditional dereference.

> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> index 82415af47d54..2f03f95945f1 100644
> --- a/drivers/gpu/drm/i915/i915_pci.c
> +++ b/drivers/gpu/drm/i915/i915_pci.c
> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>  		(struct intel_device_info *) ent->driver_data;
>  	int err;
>  
> +	if (!intel_info)
> +		return -ENODEV;
> +
>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>  		dev_info(&pdev->dev,
>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
> -- 
> 2.43.0
> 

-- 
Best Regards,
Krzysztof

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Jani Nikula]

On Tue, 11 Aug 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> Hi Deepanshu,
>
> On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
>> pci_match_device() can return the dummy pci_device_id_any entry
>> when a device is force-bound via sysfs driver_override, in which
>> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
>> struct intel_device_info * unconditionally and dereferences
>> intel_info->require_force_probe, causing a NULL-ptr-deref.
>> 
>> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
>> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
>> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
> This "Fixes" tag should point to the commit that breaks stuff,

In general, agreed...

> I believe, so what you are looking for is
> 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
> since this patch introduced that unconditional dereference.

...but that didn't introduce the unconditional reference. I think it was
always there. We've always expected .driver_data to point at whatever we
have specified in MODULE_DEVICE_TABLE().

I'd just slap a Cc: stable on it without Fixes.


BR,
Jani.

>
>> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
>> ---
>>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
>>  1 file changed, 3 insertions(+)
>> 
>> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
>> index 82415af47d54..2f03f95945f1 100644
>> --- a/drivers/gpu/drm/i915/i915_pci.c
>> +++ b/drivers/gpu/drm/i915/i915_pci.c
>> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>>  		(struct intel_device_info *) ent->driver_data;
>>  	int err;
>>  
>> +	if (!intel_info)
>> +		return -ENODEV;
>> +
>>  	if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>>  		dev_info(&pdev->dev,
>>  			 "Your graphics device %04x is not properly supported by i915 in this\n"
>> -- 
>> 2.43.0
>> 

-- 
Jani Nikula, Intel

Re: [PATCH] drm/i915: Guard against NULL driver_data in i915_pci_probe()

[Deepanshu Kartikey]

On Tue, Aug 11, 2026 at 3:01 PM Jani Nikula <jani.nikula@linux.intel.com> wrote:
>
> On Tue, 11 Aug 2026, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
> > Hi Deepanshu,
> >
> > On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
> >> pci_match_device() can return the dummy pci_device_id_any entry
> >> when a device is force-bound via sysfs driver_override, in which
> >> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
> >> struct intel_device_info * unconditionally and dereferences
> >> intel_info->require_force_probe, causing a NULL-ptr-deref.
> >>
> >> Reported-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> >> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
> >> Tested-by: syzbot+db96c5ff032f4292a8dc@syzkaller.appspotmail.com
> >> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to i915_pci.c")
> > This "Fixes" tag should point to the commit that breaks stuff,
>
> In general, agreed...
>
> > I believe, so what you are looking for is
> > 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support")
> > since this patch introduced that unconditional dereference.
>
> ...but that didn't introduce the unconditional reference. I think it was
> always there. We've always expected .driver_data to point at whatever we
> have specified in MODULE_DEVICE_TABLE().
>
> I'd just slap a Cc: stable on it without Fixes.
>
>
> BR,
> Jani.
>
> >
> >> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> >> ---
> >>  drivers/gpu/drm/i915/i915_pci.c | 3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
> >> index 82415af47d54..2f03f95945f1 100644
> >> --- a/drivers/gpu/drm/i915/i915_pci.c
> >> +++ b/drivers/gpu/drm/i915/i915_pci.c
> >> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> >>              (struct intel_device_info *) ent->driver_data;
> >>      int err;
> >>
> >> +    if (!intel_info)
> >> +            return -ENODEV;
> >> +
> >>      if (intel_info->require_force_probe && !id_forced(pdev->device)) {
> >>              dev_info(&pdev->dev,
> >>                       "Your graphics device %04x is not properly supported by i915 in this\n"
> >> --
> >> 2.43.0
> >>
>
> --
> Jani Nikula, Intel

Thanks for the review. I have sent patch v2.

Deepanshu