syzbot
general protection fault in i915_pci_probe
Status:
upstream: reported C repro on 2026/08/04 21:46
Bug presence:
origin:upstream
[Documentation on labels]
Reported-by: syzbot+6755b1b4bc8ee75fcba4@syzkaller.appspotmail.com
First crash: 3d05h, last: 1d13h
▶
▼
Bug presence (1)
| Date |
Name |
Commit |
Repro |
Result |
| 2026/08/07 |
upstream (ToT) |
3f008280327b |
C
|
[report] general protection fault in i915_pci_probe
|
Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 PID: 13 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events work_for_cpu_fn
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90000d27ae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4169aee20 CR3: 00000000767e4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
local_pci_probe+0xc5/0x150 drivers/pci/pci-driver.c:323
work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5217
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 0d9e3800050f992f ]---
RIP: 0010:i915_pci_probe+0xa1/0x450 drivers/gpu/drm/i915/i915_pci.c:1172
Code: fd fc 49 8d 5e 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 5d 83 42 fd 48 8b 1b 48 83 c3 28 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 e0 02 00 00 0f b7 1b 89 de 83 e6 04 31
RSP: 0018:ffffc90000d27ae0 EFLAGS: 00010206
RAX: 0000000000000005 RBX: 0000000000000028 RCX: ffff88813fe20000
RDX: 0000000000000000 RSI: ffffffff8a7ed380 RDI: ffff88801bc6e000
RBP: ffffc90000d27bd0 R08: ffffffff901ee117 R09: 1ffffffff203dc22
R10: dffffc0000000000 R11: fffffbfff203dc23 R12: 1ffff920001a4f64
R13: ffff88801bc6e000 R14: ffffffff8a7ed380 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4169aee20 CR3: 000000002ab5f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: fd std
1: fc cld
2: 49 8d 5e 18 lea 0x18(%r14),%rbx
6: 48 89 d8 mov %rbx,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 48 89 df mov %rbx,%rdi
17: e8 5d 83 42 fd call 0xfd428379
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 28 add $0x28,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 e0 02 00 00 jne 0x317
37: 0f b7 1b movzwl (%rbx),%ebx
3a: 89 de mov %ebx,%esi
3c: 83 e6 04 and $0x4,%esi
3f: 31 .byte 0x31
Struck through repros no longer work on HEAD.