Hi,
I am reporting a general protection fault in the i915 PCI probe path, triggered by a syzkaller reproducer. The issue is reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1). The reproducer mounts sysfs, writes "i915" to the driver_override attribute of PCI device 0000:00:01.0, and then writes the device name to the i915 driver's bind attribute. This binds the i915 driver to a PCI device it was never meant to drive. The probe runs in the workqueue worker kworker/0:1 in the work_for_cpu_fn context. KASAN reports a null-ptr-deref in the range [0x18-0x1f] and the console shows a general protection fault for the non-canonical address 0xdffffc0000000003, with RIP in i915_pci_probe. The path reaches the driver through local_pci_probe and pci_call_probe from the sysfs bind store. One possible cause is that i915_pci_probe takes per-device information that is only populated for devices the driver is supposed to match, and dereferences it without a validity check, so a forced bind on an unrelated PCI device leads to a NULL dereference. This looks like a missing guard against a driver/device mismatch on the probe path. I am reporting the fault and the path as observed. This appears to be a recurrence of the syzbot issue whose external id is 6755b1b4bc8ee75fcba4. It remains reproducible on v7.3-rc1. Reproducer: syz reproducer: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='i915\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/drivers/i915/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='0000:00:01.0\x00', 0xd) console output: https://pastebin.com/raw/HkYrAy1P kernel config: https://pastebin.com/raw/2GLbmWHF Kernel: HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935 git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object e5e04726cdd043e309677071ab1b65a4b18f422b kernel version: 7.3.0-rc1 #1 PREEMPT(full) tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30) Let me know if you need more details or testing. Best regards, Changjian
