A PCI driver_override bind can reach dwc3_pci_probe() with the dummy ID
from pci_match_device(). Its driver_data is zero, so dwc3_pci_quirks()
passes NULL to device_add_software_node(), which crashes in
software_node_register().
Reject the match before enabling the device or allocating resources.
All static DWC3 PCI IDs provide software-node data.
Build-tested with ARCH=arm64 defconfig and dwc3-pci.o. The runtime
reproducer could not be run in this environment.
Fixes: e492ce9bcaa1 ("usb: dwc3: pci: Register a software node for the dwc3
platform device")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=665bae0a102933788e1a
Assisted-by: LLM
Signed-off-by: By <[email protected]>
---
drivers/usb/dwc3/dwc3-pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 6c1cbb722..d7fdf6ca6 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -335,6 +335,9 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct
pci_device_id *id)
int ret;
struct device *dev = &pci->dev;
+ if (!id->driver_data)
+ return -ENODEV;
+
ret = pcim_enable_device(pci);
if (ret) {
dev_err(dev, "failed to enable pci device\n");
--
2.55.0
