⬢ DragonFlyBSD Kernel Audit
DF-4051 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-4051",
  "title": "nfe_stop() deadlocks the callout subsystem against nfe_tick (AB-BA): synchronous callout_stop() under the driver serializer vs a tick callback parked in lwkt_serialize_enter",
  "verdict": "inconclusive",
  "impact": "dos",
  "reproduce": {
    "build": "cd /root/nfereplica && make",
    "run": "kldload nfereplica.ko; sysctl kern.nfereplica.arm=1; sleep 2; (sysctl kern.nfereplica.stop=1 &); sleep 6; dmesg | grep nfereplica | tail -4; ps -o pid,stat,wchan,command -ax | grep -E 'stop=1|softclock'",
    "expected": "console stops at 'IF THIS IS THE LAST nfereplica LINE, AB-BA DEADLOCK IS PROVEN'; ps shows the stop sysctl in D2 wchan 'costp' and one (softclock N) in wchan 'slize', permanently; guest needs vm.sh reset with-src to recover"
  },
  "kernel_refs": [
    "sys/dev/netif/nfe/if_nfe.c:636",
    "sys/dev/netif/nfe/if_nfe.c:1591",
    "sys/dev/netif/nfe/if_nfe.c:1593",
    "sys/dev/netif/nfe/if_nfe.c:2187",
    "sys/dev/netif/nfe/if_nfe.c:2190",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "nfereplica.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "serial_console.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}