[BUG] drm/i915: general protection fault in i915_pci_probe on forced bind

[BUG] drm/i915: general protection fault in i915_pci_probe on forced bind

[CJ]

Hi,


I am reporting a general protection fault in the i915 PCI probe path, triggered
by a syzkaller reproducer.  The issue is reproducible with HEAD commit
cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts sysfs, writes "i915" to the driver_override attribute of
PCI device 0000:00:01.0, and then writes the device name to the i915 driver's
bind attribute.  This binds the i915 driver to a PCI device it was never meant
to drive.


The probe runs in the workqueue worker kworker/0:1 in the work_for_cpu_fn
context.  KASAN reports a null-ptr-deref in the range [0x18-0x1f] and the
console shows a general protection fault for the non-canonical address
0xdffffc0000000003, with RIP in i915_pci_probe.  The path reaches the driver
through local_pci_probe and pci_call_probe from the sysfs bind store.


One possible cause is that i915_pci_probe takes per-device information that is
only populated for devices the driver is supposed to match, and dereferences it
without a validity check, so a forced bind on an unrelated PCI device leads to a
NULL dereference.  This looks like a missing guard against a driver/device
mismatch on the probe path.  I am reporting the fault and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
6755b1b4bc8ee75fcba4.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='i915\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/drivers/i915/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000600)='0000:00:01.0\x00', 0xd)


console output: https://pastebin.com/raw/HkYrAy1P
kernel config: https://pastebin.com/raw/2GLbmWHF


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian

Re: [BUG] drm/i915: general protection fault in i915_pci_probe on forced bind

[Jani Nikula]

On Mon, 14 Sep 2026, CJ <firefly0158@163.com> wrote:
> I am reporting a general protection fault in the i915 PCI probe path, triggered
> by a syzkaller reproducer.  The issue is reproducible with HEAD commit
> cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).

Try v7.3-rc2.

> The reproducer mounts sysfs, writes "i915" to the driver_override attribute of
> PCI device 0000:00:01.0, and then writes the device name to the i915 driver's
> bind attribute.  This binds the i915 driver to a PCI device it was never meant
> to drive.

Is that a sane use case, though?


BR,
Jani.

-- 
Jani Nikula, Intel