⬢ DragonFlyBSD Kernel Audit
DF-2212 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
{
  "finding_id": "DF-2212",
  "finding": "ttm_exit() deadlocks forever in uninterruptible wait_event on a condition that can never become true (sys/dev/drm/ttm/ttm_module.c:98)",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "rig": "verbatim-interposition kernel-compiled harness: harness df_ttm2212.c #includes the REAL sys/dev/drm/ttm/ttm_module.c (sha256-gated, byte-identical guest/audited trees) plus verbatim lkpi linux_wait.c/linux_sched.c into kernel config DFV2212 = X86_64_GENERIC + device dfverify (INVARIANTS+DDB preserved); drm_sysfs externs provided with exactly the shipped no-op semantics (drm_sysfs.c:60-75); module_init(ttm_init) runs at boot as control; sysctl hw.df_ttm2212.trigger calls the real ttm_exit() in the calling thread (same thread-context as linker_file_sysuninit kern_linker.c:535 gives the kldunload(2) thread); 5s callout watchdog samples the blocked thread",
  "reproduce": {
    "build": "sh build.sh baseline (make -j6 nativekernel KERNCONF=DFV2212); cp kernel.stripped/kernel.debug to /boot/kernel; reboot; then cp ttm_module_fixed.c over the tree file, sh build.sh fixed, reinstall, reboot",
    "run": "sh run.sh (baseline), sh run_fixed.sh (fixed)",
    "expected": "baseline: trigger process in ps state D0 wchan lwe at t=3/6/33/93s, survives kill -9 (kernel-side sigkill_pending=1 in all 16 watchdog samples), device_released=0 throughout, WATCHDOG VERDICT line, sysctl never returns; fixed: ttm_exit() RETURNED after 0 ms, 500 x (ttm_init;ttm_exit) cycles complete, no stuck processes"
  },
  "kernel_refs": [
    "sys/dev/drm/ttm/ttm_module.c:37",
    "sys/dev/drm/ttm/ttm_module.c:38",
    "sys/dev/drm/ttm/ttm_module.c:40",
    "sys/dev/drm/ttm/ttm_module.c:48",
    "sys/dev/drm/ttm/ttm_module.c:50",
    "sys/dev/drm/ttm/ttm_module.c:56",
    "sys/dev/drm/ttm/ttm_module.c:77",
    "sys/dev/drm/ttm/ttm_module.c:84",
    "sys/dev/drm/ttm/ttm_module.c:98",
    "sys/dev/drm/include/linux/wait.h:121",
    "sys/dev/drm/include/linux/wait.h:130",
    "sys/dev/drm/include/linux/wait.h:135",
    "sys/dev/drm/include/linux/wait.h:171",
    "sys/dev/drm/include/linux/module.h:58",
    "sys/dev/drm/include/linux/module.h:60",
    "sys/dev/drm/include/linux/device.h:106",
    "sys/dev/drm/drm_sysfs.c:60",
    "sys/dev/drm/drm_sysfs.c:73",
    "sys/dev/drm/linux_sched.c:59",
    "sys/kern/kern_linker.c:188",
    "sys/kern/kern_linker.c:533",
    "sys/kern/kern_linker.c:535"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "df_ttm2212.c",
    "build.sh",
    "run.sh",
    "run_fixed.sh",
    "ttm_module_fixed.c",
    "fix.diff",
    "build.log",
    "fix_build.log",
    "run.log",
    "run_fixed.log",
    "trigger.out",
    "dmesg.txt",
    "env.txt",
    "manifest.json",
    "verdict.json",
    "SHA256SUMS.artifacts"
  ]
}