⬢ DragonFlyBSD Kernel Audit
DF-2728 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-2728",
  "title": "lwkt_preempt() KKASSERT(gd->gd_processing_ipiq == 0) contradicts the designed preemption-from-framed-IPI path in lwkt_schedule_remote() (INVARIANTS panic)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cd /tmp/df2728 && make obj && make   (kmod.mk against /usr/src/sys, INVARIANTS X86_64_GENERIC kernel)",
    "run": "usched :1 kldload /usr/obj/tmp/df2728/df2728.ko; (usched :2 /usr/local/bin/spin &); usched :1 sysctl -n debug.df2728=3; usched :1 sysctl -n debug.df2728=1",
    "expected": "mode3 control: 'ok, no panic (control)'. mode1: panic: assertion \"gd->gd_processing_ipiq == 0\" failed in lwkt_preempt at /usr/src/sys/kern/lwkt_thread.c:1026, cpuid = 1, trace lwkt_preempt <- lwkt_schedule_remote <- lwkt_process_ipiq_core <- lwkt_process_ipiq_frame"
  },
  "kernel_refs": [
    "sys/kern/lwkt_thread.c:1026",
    "sys/kern/lwkt_thread.c:1336-1348",
    "sys/kern/lwkt_thread.c:1274-1314",
    "sys/kern/lwkt_thread.c:1042-1057",
    "sys/kern/lwkt_ipiq.c:605",
    "sys/platform/pc64/apic/apic_vector.s:337-358",
    "sys/platform/pc64/x86_64/ipl.s:309-325",
    "sys/kern/kern_intr.c:336"
  ],
  "artifacts": [
    "df2728.c", "Makefile", "build.sh", "run.sh", "build.log", "run.log",
    "panic.txt", "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"
  ]
}