DF-4704
get_pixel_size() integer-divides depth by 8 and the blit/fill dispatch falls through to 32-bit ops — 8bpp KMS console gets 4-byte/pixel writes on a 1-byte/pixel stride (OOB writes past the framebuffer mapping)
Summary
For depths 8..15 get_pixel_size returns 1 while blit_blk and kms_draw_border fall through to the 32-bit ops (writel 4 bytes/px) on the true 1-byte stride: each text row overruns its scanline by 3*width bytes and the last rows write past the fb mapping end on the very first console clear. Reachable via video=...@8 boot config on a drm KMS console (root/boot-gated footgun). fill_rect16/32 verified correct (no DF-1818 twin). Switch-total + refuse-to-draw fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4704 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware/boot-flag gated
fix in finding markdown
per-fix-DF-4704
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
get_pixel_size integer-divides depth/8: depths 8..15 return 1 while the blit/fill dispatch falls through to the 32-bit ops (writel 4 bytes/px) - each text row overruns its scanline by 3*width bytes and the last rows write past the fb mapping. fill_rect16/32 verified correct (no DF-1818 twin); the known 24-bit slow-path is the only other stride defect. Switch-return-0 + refuse-to-draw fix.
Verdict
not_run: boot-flag gated (video=...@8) and no drm KMS console on the QEMU guest; arithmetic source-certain
No comments yet.