⬢ DragonFlyBSD Kernel Audit
DF-4401 / trigger.c
← back to finding ↓ download raw
/*
 * DF-4401: no compileable local trigger — the race needs a distressed 3ware
 * controller so that two of {ccb-timeout callout, controller-error interrupt,
 * passthrough ETIMEDOUT thread} enter tws_reset() together. Reproduction
 * recipe on hardware:
 *
 *   1. put the adapter under I/O with commands that time out (e.g. pull a
 *      expander / stall the firmware) so ccb timeouts fire;
 *   2. concurrently induce a microcontroller-error doorbell (TWS_BIT21) or a
 *      TWS_IOCTL_FIRMWARE_PASS_THROUGH command that never completes (60 s
 *      lksleep timeout -> tws_reset from the ioctl thread, tws_user.c:146).
 *
 * Expected: INVARIANTS kernel panics at tws.c:666 KASSERT; production kernel
 * leaves the SIM queue frozen forever (xpt_freeze_simq leak) and all adapter
 * I/O hangs.
 */
int main(void) { return 0; }