On Tue, 11 Aug 2026, Krzysztof Karas <[email protected]> wrote:
> Hi Deepanshu,
>
> On 2026-08-09 at 14:34:30 +0530, Deepanshu Kartikey wrote:
>> pci_match_device() can return the dummy pci_device_id_any entry
>> when a device is force-bound via sysfs driver_override, in which
>> case ->driver_data is unset (NULL). i915_pci_probe() casts it to
>> struct intel_device_info * unconditionally and dereferences
>> intel_info->require_force_probe, causing a NULL-ptr-deref.
>>
>> Reported-by: [email protected]
>> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc
>> Tested-by: [email protected]
>> Fixes: 42f5551d2769 ("drm/i915: Split out the PCI driver interface to
>> i915_pci.c")
> This "Fixes" tag should point to the commit that breaks stuff,
In general, agreed...
> I believe, so what you are looking for is
> 7ef5ef5cdead ("drm/i915: add force_probe module parameter to replace
> alpha_support")
> since this patch introduced that unconditional dereference.
...but that didn't introduce the unconditional reference. I think it was
always there. We've always expected .driver_data to point at whatever we
have specified in MODULE_DEVICE_TABLE().
I'd just slap a Cc: stable on it without Fixes.
BR,
Jani.
>
>> Signed-off-by: Deepanshu Kartikey <[email protected]>
>> ---
>> drivers/gpu/drm/i915/i915_pci.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/i915/i915_pci.c
>> b/drivers/gpu/drm/i915/i915_pci.c
>> index 82415af47d54..2f03f95945f1 100644
>> --- a/drivers/gpu/drm/i915/i915_pci.c
>> +++ b/drivers/gpu/drm/i915/i915_pci.c
>> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const
>> struct pci_device_id *ent)
>> (struct intel_device_info *) ent->driver_data;
>> int err;
>>
>> + if (!intel_info)
>> + return -ENODEV;
>> +
>> if (intel_info->require_force_probe && !id_forced(pdev->device)) {
>> dev_info(&pdev->dev,
>> "Your graphics device %04x is not properly supported
>> by i915 in this\n"
>> --
>> 2.43.0
>>
--
Jani Nikula, Intel
