DF-5221
framebuffer_alloc() ignores its size argument and never sets info->par β silent API-contract divergence, latent NULL-deref for any caller passing size > 0
Summary
LinuxKPI shim kzallocs only sizeof(struct fb_info), ignoring size and never setting info->par - Linux allocates the tail and points par at it. Sole in-tree caller passes 0 and assigns par itself, so latent only; any future ported caller following the Linux contract gets an attach-time NULL deref. Honor-the-contract fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5221 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 898 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5221
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (Low/Info per contract; static trace only)
No comments yet.