[PATCH] fbdev: ssd1307fb: fix NULL pointer dereference on missing match data

device_get_match_data() can return NULL, e.g. when the device is matched
through the I2C device ID table rather than the OF match table. The
returned value is stored in par->device_info and later dereferenced when
initializing par->vcomh, causing a NULL pointer dereference.

Check the return value right after the assignment and bail out with
-ENODEV (releasing the already allocated framebuffer) before any
dereference.

Signed-off-by: Yang Zi <redacted>
---

diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index c4fdecafd856..4d185c754284 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c

@@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)

     spin_lock_init(&par->damage_lock);
 
     par->device_info = device_get_match_data(dev);
+    if (!par->device_info) {
+        ret = -ENODEV;
+        goto fb_alloc_error;
+    }
 
     par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
     if (IS_ERR(par->reset)) {

On 8/25/26 10:58, Yang Zi wrote:

device_get_match_data() can return NULL, e.g. when the device is matched
through the I2C device ID table rather than the OF match table. The
returned value is stored in par->device_info and later dereferenced when
initializing par->vcomh, causing a NULL pointer dereference.

Check the return value right after the assignment and bail out with
-ENODEV (releasing the already allocated framebuffer) before any
dereference.

Signed-off-by: Yang Zi <redacted>

The patch did not apply cleanly. I fixed it up manually and applied it.

Thanks!
Helge