Boot-time ktr_buf/ktr_entries_mask publication relies on TSO (no explicit read-side barrier, x86-only safe)
Summary
ktr_sysinit (kern_ktr.c:233-242): publishes per-CPU ktr_buf BEFORE updating global ktr_entries_mask BOOT0->full (:241-242). No explicit read-side barrier in ktr_begin_write_entry (:511). On x86 TSO safe (stores observed in program order, cpu_sfence :240 redundant). NOT enforced for weak-order archs (no READ_ONCE/acquire). One-time SI_BOOT2_KLD before userspace; index mask still clamps valid slot on x86. Not exploitable as shipped. Fix: release/acquire accessors or per-CPU mask.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0104 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 389 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_ktr.c:231: ktr_buf published before ktr_entries_mask update (x86 TSO safe)
Verified recommended fix
Source-confirmed at sys/kern/kern_ktr.c:231: ktr_buf published before ktr_entries_mask update (x86 TSO safe)
Verdict
Source-confirmed at sys/kern/kern_ktr.c:231: ktr_buf published before ktr_entries_mask update (x86 TSO safe)
No comments yet.