⬢ DragonFlyBSD Kernel Audit
DF-4602 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-4602",
  "file": "sys/dev/sound/pcm/feeder_chain.c",
  "title": "Guest-wide starvation/livelock during unprivileged dsp format-change storms (inconclusive; unconditional per-ioctl console spam is the in-file surface)",
  "verdict": "inconclusive",
  "impact": "dos",
  "reproduced": false,
  "reproduce": {
    "build": "guest$ cc -O2 -o /tmp/feeder_fuzz /tmp/feeder_fuzz.c   (as maxx)",
    "run": "./run.sh (see file for the concurrent root churn loop); watch host qemu CPU% + ssh health ~7min",
    "expected": "ONE-SHOT: minutes-long ssh starvation with 94-107% qemu CPU and continuing feeder_build_* console spam (wedge-serial-full.log). NOT reproduced in rerun1 (minimal) and rerun2 (full recipe) — see rerun1.log/rerun2.log."
  },
  "kernel_refs": [
    "sys/dev/sound/pcm/feeder_chain.c:153",
    "sys/dev/sound/pcm/feeder_chain.c:164",
    "sys/dev/sound/pcm/feeder_chain.c:227",
    "sys/dev/sound/pcm/feeder_chain.c:237",
    "sys/dev/sound/pcm/feeder_chain.c:575",
    "sys/dev/sound/pcm/feeder_chain.c:578"
  ],
  "artifacts": [
    "feeder_fuzz.c", "wedge-serial-full.log", "rerun1.log", "rerun2.log",
    "README.md", "VERDICT.md", "build.sh", "run.sh", "env.txt", "fix.diff",
    "verdict.json", "manifest.json"
  ]
}