Hi Deepanshu, On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote: > pci_match_device() can return the dummy pci_device_id_any entry > when a device is force-bound via sysfs driver_override, in which > case ->driver_data is unset (NULL). i915_pci_probe() casts it to > struct intel_device_info * unconditionally and dereferences > intel_info->require_force_probe, causing a NULL-ptr-deref. > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc > Tested-by: [email protected] > Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to > i915_pci.c") This "Fixes" tag should point to the commit that breaks stuff, I believe, so what you are looking for is 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace alpha_support") since this patch introduced that unconditional dereference.
> Signed-off-by: Deepanshu Kartikey <[email protected]> > --- > drivers/gpu/drm/i915/i915_pci.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c > index 82415af47d54..2f03f95945f1 100644 > --- a/drivers/gpu/drm/i915/i915_pci.c > +++ b/drivers/gpu/drm/i915/i915_pci.c > @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const > struct pci_device_id *ent) > (struct intel_device_info *) ent->driver_data; > int err; > > + if (!intel_info) > + return -ENODEV; > + > if (intel_info->require_force_probe && !id_forced(pdev->device)) { > dev_info(&pdev->dev, > "Your graphics device %04x is not properly supported > by i915 in this\n" > -- > 2.43.0 > -- Best Regards, Krzysztof
