⬢ DragonFlyBSD Kernel Audit
DF-4694 / manifest.json
← back to finding ↓ download raw
{
  "finding_id": "DF-4694",
  "title": "sili_pm_softreset polls with sili_quick_timeout whose sole-active KKASSERT is violated by co-active PM-target commands (XPT_RESET_DEV path takes no exclusive access)",
  "verdict": "inconclusive",
  "impact": "none (expected: KKASSERT panic at sili.c:2537 on INVARIANTS kernels incl. X86_64_GENERIC, or force-reinit aborting unrelated in-flight commands; guest has no sili HBA / PM emulation)",
  "confidence": "likely",
  "reproduce": {
    "build": "sh build.sh   (cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c)",
    "run": "sh run.sh      (camcontrol reset storm = XPT_RESET_DEV driver)",
    "expected": "on PM hardware: camcontrol reset of a PM target while another target's command is on-chip and the softreset FIS times out -> panic 'assertion (ap->ap_active & ~ap->ap_expired) == (1 << ccb->ccb_slot) failed'; on this guest: resets of ata0/ata1 succeed benignly"
  },
  "kernel_refs": [
    "sys/dev/disk/sili/sili_pm.c:445-457",
    "sys/dev/disk/sili/sili.c:2527-2548",
    "sys/dev/disk/sili/sili_cam.c:904-915",
    "sys/dev/disk/sili/sili.c:733-750",
    "sys/dev/disk/sili/sili.c:625-635",
    "sys/dev/disk/sili/sili_pm.c:272"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_sili_pm.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}