⬢ DragonFlyBSD Kernel Audit
DF-4046 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4046",
  "title": "stge_stop() can deadlock the callout subsystem against stge_tick (synchronous callout_stop under the driver serializer; unconditional under-lock self re-arm) - DF-3715(em)/DF-4025(re) family, stge instance",
  "verdict": "inconclusive",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/stgereplica && make",
    "run": "kldload stgereplica.ko; sysctl kern.stgereplica.arm=1; sleep 2; (sysctl kern.stgereplica.stop=1 &); sleep 6; dmesg | grep stgereplica | tail -4; ps -o pid,stat,wchan,command -ax | grep stop=1",
    "expected": "dmesg ends at 'AB-BA DEADLOCK IS PROVEN'; stopper thread stuck D-state wchan 'costp'; softclock thread blocked wchan 'slize'; observing shell never completes; guest cannot shut down cleanly"
  },
  "kernel_refs": [
    "sys/dev/netif/stge/if_stge.c:587",
    "sys/dev/netif/stge/if_stge.c:1758",
    "sys/dev/netif/stge/if_stge.c:1775",
    "sys/dev/netif/stge/if_stge.c:1777",
    "sys/dev/netif/stge/if_stge.c:1900",
    "sys/dev/netif/stge/if_stge.c:1907",
    "sys/dev/netif/stge/if_stge.c:1280",
    "sys/dev/netif/stge/if_stge.c:1438",
    "sys/dev/netif/stge/if_stge.c:2098",
    "sys/dev/netif/stge/if_stge.c:2111",
    "sys/dev/netif/stge/if_stge.c:2166",
    "sys/kern/kern_timeout.c:1091",
    "sys/kern/kern_timeout.c:920"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "stgereplica.c", "Makefile", "build.sh",
    "run.sh", "build.log", "run.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}