Lock-order inversion between sysctl_rman and rman_fini creates ABBA deadlock potential (rman_fini dead code)
Summary
sysctl_rman acquires rman_tok (:669) then rm_slock (:698). rman_fini acquires rm_slock (:162) then rman_tok (:174) = ABBA inversion. rm_hold cannot help deadlock occurs before fini reaches rm_hold check. rman_fini has NO in-tree caller (dead code) so not currently exploitable. sysctl hw.bus.rman unprivileged CTLFLAG_RD. Would deadlock if module calls rman_fini during detach while user reads sysctl. Fix: consistent lock order acquire rman_tok before rm_slock in fini.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0091 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 385 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_rman.c:155: lock-order inversion between sysctl_rman and rman_fini (dead code)
Verified recommended fix
Source-confirmed at sys/kern/subr_rman.c:155: lock-order inversion between sysctl_rman and rman_fini (dead code)
Verdict
Source-confirmed at sys/kern/subr_rman.c:155: lock-order inversion between sysctl_rman and rman_fini (dead code)
No comments yet.