DF-4491
intel_lvds_init failed-path leaks the DDC EDID buffer when the EDID yields no preferred mode
Summary
On the failed unwind of intel_lvds_init, lvds_connector is kfreed without freeing base.edid - its only release point is intel_lvds_destroy, which the failed path bypasses by calling drm_connector_cleanup + kfree directly. Requires an LVDS panel whose EDID advertises modes but none flagged preferred, with no VBT LFP mode and a cold panel. One-shot probe-time heap leak, bounded by driver reload. Free-the-edid-on-unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4491 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 944 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
kfree edid on failed unwind in finding markdown
per-fix-DF-4491
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
failed: unwind kfrees lvds_connector without freeing base.edid (only intel_lvds_destroy releases it). Requires LVDS panel with modes-but-no-preferred-bit EDID and no VBT LFP mode. Info; PoC skipped per contract.
Verdict
not_run: Info hygiene finding, hardware-gated
No comments yet.