⬢ DragonFlyBSD Kernel Audit
DF-4890 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4890",
  "title": "AcpiOsAcquireLock idle-thread/normal-thread split uses disjoint primitives (spinlock vs lockmgr) — no cross-class mutual exclusion",
  "verdict": "not_reproduced",
  "impact": "none (potential dos on hardware with ACPI C2/C3; defect itself statically certain)",
  "reproduce": {
    "build": "no compile required",
    "run": "dfbsd-qemu/vm.sh run_root 'sh precond_probe.sh'   (guest precondition check); on real C2/C3 hardware: sh race_trigger.sh as root with cx_lowest=C3",
    "expected": "guest: PRECONDITION C2/C3: ABSENT (idle-side taker never runs). real hw + instrumented kernel: AcpiOsAcquireLock(AcpiGbl_HardwareLock) branch-overlap counter > 0"
  },
  "kernel_refs": [
    "sys/dev/acpica/Osd/OsdSynch.c:374-403",
    "sys/dev/acpica/Osd/OsdSynch.c:405-429",
    "sys/dev/acpica/acpi_cpu_cstate.c:786",
    "sys/dev/acpica/acpi_cpu_cstate.c:933-935",
    "sys/dev/acpica/acpi_cpu_cstate.c:957-977",
    "sys/contrib/dev/acpica/source/components/hardware/hwxface.c:411-471",
    "sys/contrib/dev/acpica/source/components/hardware/hwregs.c:574-581",
    "sys/contrib/dev/acpica/source/components/utilities/utmutex.c:206-218"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "precond_probe.sh",
    "race_trigger.sh",
    "run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}