Hi Sebastian,
On 2026-07-16 at 12:14:33 +0200, Sebastian Brzezinka wrote:
> When a driver's fbdev probe callback fails before assigning
> fb_helper->funcs (e.g. i915's intel_fbdev_driver_fbdev_probe() bailing
> out early on a DMA/GGTT pin failure), the fbdev client stays registered
> with fb_helper->funcs == NULL. Any later restore, such as on drm fd close
> via drm_client_dev_restore() -> drm_fbdev_client_restore(), reaches
> __drm_fb_helper_restore_fbdev_mode_unlocked() and unconditionally
> dereferences fb_helper->funcs->fb_restore, causing a NULL pointer
> dereference.
>
> Guard the fb_restore call with a NULL check on fb_helper->funcs.
>
> Fixes: 2ef5754c9649 ("drm/i915/display: fbdev: Move custom restore code to
> new callback")
> Signed-off-by: Sebastian Brzezinka <[email protected]>
> ---
> drivers/gpu/drm/drm_fb_helper.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
> index 7b11a582f8ec..77ae9bd5ef3d 100644
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -146,7 +146,7 @@ __drm_fb_helper_restore_fbdev_mode_unlocked(struct
> drm_fb_helper *fb_helper,
> if (do_delayed)
> drm_fb_helper_hotplug_event(fb_helper);
>
> - if (fb_helper->funcs->fb_restore)
> + if (fb_helper->funcs && fb_helper->funcs->fb_restore)
> fb_helper->funcs->fb_restore(fb_helper);
>
> return ret;
> --
> 2.53.0
>
LGTM:
Reviewed-by: Krzysztof Karas <[email protected]>
--
Best Regards,
Krzysztof
