* [PATCH] fbdev: ssd1307fb: fix NULL pointer dereference on missing match data
@ 2026-08-25 8:58 Yang Zi
2026-09-10 20:02 ` Helge Deller
0 siblings, 1 reply; 2+ messages in thread
From: Yang Zi @ 2026-08-25 8:58 UTC (permalink / raw)
To: deller, linux-fbdev
Cc: sh_def, nihaal, u.kleine-koenig, dri-devel, linux-kernel
device_get_match_data() can return NULL, e.g. when the device is matched
through the I2C device ID table rather than the OF match table. The
returned value is stored in par->device_info and later dereferenced when
initializing par->vcomh, causing a NULL pointer dereference.
Check the return value right after the assignment and bail out with
-ENODEV (releasing the already allocated framebuffer) before any
dereference.
Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index c4fdecafd856..4d185c754284 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)
spin_lock_init(&par->damage_lock);
par->device_info = device_get_match_data(dev);
+ if (!par->device_info) {
+ ret = -ENODEV;
+ goto fb_alloc_error;
+ }
par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
if (IS_ERR(par->reset)) {
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] fbdev: ssd1307fb: fix NULL pointer dereference on missing match data
2026-08-25 8:58 [PATCH] fbdev: ssd1307fb: fix NULL pointer dereference on missing match data Yang Zi
@ 2026-09-10 20:02 ` Helge Deller
0 siblings, 0 replies; 2+ messages in thread
From: Helge Deller @ 2026-09-10 20:02 UTC (permalink / raw)
To: Yang Zi, linux-fbdev; +Cc: sh_def, dri-devel, linux-kernel
On 8/25/26 10:58, Yang Zi wrote:
> device_get_match_data() can return NULL, e.g. when the device is matched
> through the I2C device ID table rather than the OF match table. The
> returned value is stored in par->device_info and later dereferenced when
> initializing par->vcomh, causing a NULL pointer dereference.
>
> Check the return value right after the assignment and bail out with
> -ENODEV (releasing the already allocated framebuffer) before any
> dereference.
>
> Signed-off-by: Yang Zi <2959243019@qq.com>
The patch did not apply cleanly. I fixed it up manually and applied it.
Thanks!
Helge
> ---
> diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
> index c4fdecafd856..4d185c754284 100644
> --- a/drivers/video/fbdev/ssd1307fb.c
> +++ b/drivers/video/fbdev/ssd1307fb.c
> @@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)
> spin_lock_init(&par->damage_lock);
>
> par->device_info = device_get_match_data(dev);
> + if (!par->device_info) {
> + ret = -ENODEV;
> + goto fb_alloc_error;
> + }
>
> par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
> if (IS_ERR(par->reset)) {
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-10 20:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-25 8:58 [PATCH] fbdev: ssd1307fb: fix NULL pointer dereference on missing match data Yang Zi
2026-09-10 20:02 ` Helge Deller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).