⬢ DragonFlyBSD Kernel Audit
DF-5201 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-5201",
  "title": "linux_task_alloc() leaks the task_struct of every pure kernel thread that evaluates current - no drop path on the lwkt_exit route",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "kldload drm; cd /tmp/DF-5201 && make",
    "run": "kldload /tmp/DF-5201/df5201.ko; sysctl hw.df5201.test=1",
    "expected": "baseline: 8/8 'PARKED: exited td=... still carries td_linux_task=... -> task LEAKED'; patched (lwkt_exit hook): 8/8 'exited td=... is clean (task dropped at lwkt_exit)'"
  },
  "kernel_refs": [
    "sys/dev/drm/linux_sched.c:58",
    "sys/dev/drm/linux_sched.c:88",
    "sys/dev/drm/include/asm/current.h:44",
    "sys/kern/kern_exit.c:708",
    "sys/kern/lwkt_thread.c:1684",
    "sys/kern/lwkt_thread.c:1740",
    "sys/kern/lwkt_thread.c:440"
  ],
  "artifacts": [
    "df5201.c", "Makefile", "build.sh", "run.sh", "build.log",
    "run.log", "run_fixed.log", "fix.diff", "env.txt",
    "manifest.json", "verdict.json"
  ]
}