Hi Sebastian,
On Thu, Jul 16, 2026 at 12:14:33PM +0200, Sebastian Brzezinka wrote:
> When a driver's fbdev probe callback fails before assigning
> fb_helper->funcs (e.g. i915's intel_fbdev_driver_fbdev_probe() bailing
> out early on a DMA/GGTT pin failure), the fbdev client stays registered
> with fb_helper->funcs == NULL. Any later restore, such as on drm fd close
> via drm_client_dev_restore() -> drm_fbdev_client_restore(), reaches
> __drm_fb_helper_restore_fbdev_mode_unlocked() and unconditionally
> dereferences fb_helper->funcs->fb_restore, causing a NULL pointer
> dereference.
>
> Guard the fb_restore call with a NULL check on fb_helper->funcs.
>
> Fixes: 2ef5754c9649 ("drm/i915/display: fbdev: Move custom restore code to
> new callback")
> Signed-off-by: Sebastian Brzezinka <[email protected]>
Reviewed-by: Andi Shyti <[email protected]>
Thanks,
Andi
