DF-5214
Dead dal_hw_factory_destroy() kfrees a struct hw_factory that only ever exists embedded in gpio_service β latent interior-pointer kfree (heap corruption) one future caller away
Summary
The destroy API implies a standalone heap allocation, but every hw_factory in the tree is an embedded gpio_service member freed with the whole service - the header-signature-inviting teardown call would kfree an interior pointer. Zero callers (dead). Delete-the-function fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5214 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 927 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5214
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (dead code / hardware-gated; Info/Low per contract)
No comments yet.