⬢ DragonFlyBSD Kernel Audit
DF-5182 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  "finding_id": "DF-5182",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "dos",
  "title": "wait_event family: condition checked before tsleep_interlock + autoremove_wake_function unconditionally unlinks entries -> in-window wake lost, stranded sleeper burns full timeout, wait_event_timeout() misreports timeout while condition is true",
  "reproduce": {
    "build": "cd /root/lwqdemo && make SYSDIR=/usr/src/sys   # lwqdemo.c + Makefile + pristine sys/dev/drm/linux_wait.c",
    "run": "kldload ./lwqdemo.ko && sleep 25 && dmesg | grep LWQ",
    "expected": "LWQ: MISREPORT #N (windowed) dt=199 ticks ... (9x) then SUMMARY: rounds_done=17 fast=8 control_ok=8 misreports=9 rescues_fired=9, verdict REPRODUCED; run.log also contains the statistical control experiment: 1666602 rounds, 0 misreports"
  },
  "kernel_refs": [
    "sys/dev/drm/include/linux/wait.h:110",
    "sys/dev/drm/include/linux/wait.h:125",
    "sys/dev/drm/include/linux/wait.h:127",
    "sys/dev/drm/include/linux/wait.h:130",
    "sys/dev/drm/include/linux/wait.h:133",
    "sys/dev/drm/linux_wait.c:37",
    "sys/dev/drm/linux_wait.c:43",
    "sys/dev/drm/linux_wait.c:49",
    "sys/dev/drm/linux_wait.c:64",
    "sys/dev/drm/include/linux/sched.h:229",
    "sys/kern/kern_synch.c:668"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "lwqdemo.c", "Makefile", "build.sh",
    "run.sh", "build.log", "run.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}