⬢ DragonFlyBSD Kernel Audit
DF-4316 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-4316",
  "file": "sys/dev/netif/lge/if_lge.c",
  "verdict": "mechanism-proven-replica",
  "impact": "permanent kernel deadlock (local DoS) on lge hardware; none on this guest (no LGE NIC)",
  "reproduce": {
    "build": "vm.sh run_root 'cd /root/lgerep && make'  (after scp of lge_callout_replica.c + Makefile)",
    "run": "vm.sh run_root 'kldload /root/lgerep/lge_callout_replica.ko; sysctl kern.lgereplica.arm=1; sleep 2; sysctl kern.lgereplica.stop_fix=1; (sysctl kern.lgereplica.stop_lge=1 &)'; then ps/dmesg from a second session",
    "expected": "stop_fix returns cleanly (pending=0, no deadlock for the try-based fix shape); stop_lge prints 'handler PARKED on our serializer ... entering callout_stop()' then 'IF THIS IS THE LAST lgereplica LINE, THE LGE_STOP AB-BA DEADLOCK IS PROVEN' and never returns; second session shows the sysctl thread in state D4 wchan 'costp' (kern_timeout.c:920). Guest must be reset afterwards."
  },
  "kernel_refs": [
    "sys/dev/netif/lge/if_lge.c:435",
    "sys/dev/netif/lge/if_lge.c:984",
    "sys/dev/netif/lge/if_lge.c:1017",
    "sys/dev/netif/lge/if_lge.c:1055",
    "sys/dev/netif/lge/if_lge.c:1211",
    "sys/dev/netif/lge/if_lge.c:1319",
    "sys/dev/netif/lge/if_lge.c:1442",
    "sys/dev/netif/lge/if_lge.c:576",
    "sys/dev/netif/lge/if_lge.c:1029",
    "sys/kern/kern_timeout.c:920",
    "sys/kern/kern_timeout.c:1091"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "lge_callout_replica.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "manifest.json", "verdict.json"
  ]
}