⬢ DragonFlyBSD Kernel Audit
DF-3982 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-3982",
  "title": "sbp(4): synchronous callout_stop() in the fwohci hard-interrupt path sleeps in 'costp' (IRQ stall + softclock wheel starvation; DF-3715 family)",
  "verdict": "inconclusive_end_to_end_mechanism_proven",
  "impact_ceiling": "FireWire IRQ-thread stall / kernel-wide sleep-timeout starvation (DoS) from hostile device",
  "reproduce": {
    "build": "cd /root/kmod && make",
    "run": "kldload ./sbpprep.ko && sysctl kern.sbpprep_armb=1 && (sysctl -n kern.sbpprep_stopb=1 >/dev/null 2>&1 </dev/null &) && sleep 3 && ps -o pid,stat,wchan,comm -ax | grep sysctl",
    "expected": "sysctl process in state D with wchan 'costp' while softclock thread of the callback CPU sits in 'bcb' (INPROG)"
  },
  "kernel_refs": [
    "sys/dev/disk/sbp/sbp.c:1600",
    "sys/dev/disk/sbp/sbp.c:2590",
    "sys/dev/disk/sbp/sbp.c:2705",
    "sys/dev/disk/sbp/sbp.c:1823",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:923",
    "sys/bus/firewire/fwohci.c:2688",
    "sys/bus/firewire/fwohci.c:2833",
    "sys/bus/firewire/fwohcivar.h:37",
    "sys/bus/firewire/firewire.c:991"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "sbp_replica.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "console_tail.txt",
    "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}