DF-5281
Vendor-database parsing: ksscanf("%80[^\n]") writes up to 81 bytes into kmalloc(80); pci_load_vendor_data() writes one byte past the preloaded blob
Summary
Maximal 80-char line writes NUL at desc[80] (lands in slab slack - benign in practice); load_vendor_data deliberately writes vendordata[size]='\n' one byte past the loaded module. Boot-time, loader-supplied blob. Width-79 + in-blob-sentinel fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5281 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1007 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5281
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace (DF-5279 also run.t2.log stage 2a in findings/poc/DF-5276/)
Verified recommended fix
see finding markdown
Verdict
untested (Low functional / Low legacy-HW race / Info boot-time; demonstrated in DF-5276 harness where applicable)
No comments yet.