⬢ DragonFlyBSD Kernel Audit
DF-5183 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-5183",
  "manifest_version": 1,
  "verdict": "reproduced",
  "impact": "dos",
  "title": "wait_on_bit_timeout() passes Linux TASK_* mode as tsleep flags (TASK_INTERRUPTIBLE never maps to PCATCH -> unkillable 'interruptible' waits) and truncates the unsigned long timeout to int at the tsleep boundary (MAX_SCHEDULE_TIMEOUT -> -1 -> 1-tick callout -> 'infinite' waits are 1 Hz polls)",
  "reproduce": {
    "build": "cd /root/lwqdemo && make SYSDIR=/usr/src/sys   # same module as DF-5182",
    "run": "kldload ./lwqdemo.ko && sleep 8 && dmesg | grep LWQ-F3",
    "expected": "LWQ-F3: tsleep(timo=(int)MAX_SCHEDULE_TIMEOUT=-1) returned rv=35 after 2 ticks with NO waker  |  LWQ-F3: wait_on_bit_timeout(MAX_SCHEDULE_TIMEOUT) on a set bit returned rv=0 after 396 ticks (exits only via the bit clear)"
  },
  "kernel_refs": [
    "sys/dev/drm/linux_wait.c:105",
    "sys/dev/drm/linux_wait.c:114",
    "sys/dev/drm/linux_wait.c:118",
    "sys/dev/drm/linux_wait.c:141",
    "sys/dev/drm/linux_wait.c:143",
    "sys/dev/drm/include/linux/sched.h:72",
    "sys/dev/drm/include/linux/sched.h:78",
    "sys/sys/param.h:324",
    "sys/kern/kern_timeout.c:971"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "lwqdemo.c", "Makefile", "build.log",
    "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}