On Sun, 30 Aug 2026, Deepanshu Kartikey <[email protected]> wrote: > On Thu, Aug 13, 2026 at 12:19 PM Deepanshu Kartikey > <[email protected]> wrote: >> >> pci_match_device() can return the dummy pci_device_id_any entry >> when a device is force-bound via sysfs driver_override, in which >> case ->driver_data is unset (NULL). i915_pci_probe() casts it to >> struct intel_device_info * unconditionally and dereferences >> intel_info->require_force_probe, causing a NULL-ptr-deref. >> >> Reported-by: [email protected] >> Closes: https://syzkaller.appspot.com/bug?extid=db96c5ff032f4292a8dc >> Tested-by: [email protected] >> Cc: [email protected] >> Signed-off-by: Deepanshu Kartikey <[email protected]> >> --- >> v2: Drop Fixes tag, this isn't a regression from a single commit - >> the unconditional dereference of ->driver_data has always assumed >> it points into a MODULE_DEVICE_TABLE()-backed entry, an assumption >> broken by the generic driver_override fallback path, not by any >> i915-specific change. Add Cc: stable instead. (Krzysztof, Jani) >> --- >> drivers/gpu/drm/i915/i915_pci.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/i915_pci.c >> b/drivers/gpu/drm/i915/i915_pci.c >> index 82415af47d54..2f03f95945f1 100644 >> --- a/drivers/gpu/drm/i915/i915_pci.c >> +++ b/drivers/gpu/drm/i915/i915_pci.c >> @@ -958,6 +958,9 @@ static int i915_pci_probe(struct pci_dev *pdev, const >> struct pci_device_id *ent) >> (struct intel_device_info *) ent->driver_data; >> int err; >> >> + if (!intel_info) >> + return -ENODEV; >> + >> if (intel_info->require_force_probe && !id_forced(pdev->device)) { >> dev_info(&pdev->dev, >> "Your graphics device %04x is not properly >> supported by i915 in this\n" >> -- >> 2.43.0 >> > > Gente Reminder. Let me know the status of this patch .
Sorry about the delay. Thanks for the patch, pushed to drm-intel-next. BR, Jani. > > Thanks > > Deepanshu -- Jani Nikula, Intel
