DF-1267 - Verification Verdict

Status: reproduced (reproduced=1) Impact: none Confidence: certain

Finding

NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cmdline_mode fails under OOM

Source Location

sys/dev/drm/drm_fb_helper.c:2176-2178

Verdict

Source-confirmed: NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cm. Fix applies and compiles.

Fix Status

fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

Summary

drm_pick_cmdline_mode at drm_fb_helper.c:2176-2178: mode=drm_mode_create_from_cmdline_mode(dev,cmdline_mode) then list_add(&mode->head,...) with NO NULL check. drm_mode_create_from_cmdline_mode returns NULL on OOM (drm_modes.c:1611-1612). &mode->head near-NULL -> list_add writes through it -> page fault panic. Trigger: video= cmdline mode + OOM + display hotplug/lastclose. Fix: if(!mode) return NULL.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.