⬢ DragonFlyBSD Kernel Audit
DF-4025 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-4025",
  "title": "re_stop(sc,TRUE) deadlocks against re_tick (callout_stop AB-BA under if_serializer): permanent D3/'costp' wedge + CPU-wide callout starvation (re(4) instance of DF-3715)",
  "verdict": "inconclusive",
  "impact": "mechanism_proven_by_replica_wedge",
  "reproduce": {
    "build": "cd /root/rereplica && make   (bsd.kmod.mk; BUILD_RC=0 in build.log)",
    "run": "kldload rereplica.ko; sysctl kern.rereplica.arm=1; (sysctl kern.rereplica.stop=1 &); sleep 6; dmesg|tail; ps -o pid,stat,wchan,command -ax|grep stop=1",
    "expected": "dmesg ends at 'IF THIS IS THE LAST rereplica LINE, AB-BA DEADLOCK IS PROVEN'; stopper permanently 'D5 costp'; guest no longer shuts down cleanly"
  },
  "kernel_refs": [
    "sys/dev/netif/re/if_re.c:604",
    "sys/dev/netif/re/if_re.c:1354",
    "sys/dev/netif/re/if_re.c:1358",
    "sys/dev/netif/re/if_re.c:1371",
    "sys/dev/netif/re/if_re.c:1380",
    "sys/dev/netif/re/if_re.c:1871",
    "sys/dev/netif/re/if_re.c:1881",
    "sys/dev/netif/re/if_re.c:1918",
    "sys/dev/netif/re/if_re.c:1988",
    "sys/dev/netif/re/if_re.c:2000",
    "sys/dev/netif/re/if_re.c:2001",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:923"
  ],
  "artifacts": ["README.md", "VERDICT.md", "rereplica.c", "Makefile", "build.sh", "build.log", "run.sh", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}