DF-0153
EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit; no bounds guard
Summary
Lock word packs bits 20-30 as EXCLWAIT(11 bits, max 2047), bit 31 as SHARED. Each waiter adds SPINLOCK_EXCLWAIT(0x00100000) via atomic_fetchadd(:206). No masking on add. 2048 waiters -> carry into bit 31 -> spurious SHARED -> mode confusion. Bounded by MAXCPU=256 (8x headroom). Not reachable today. Defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0153 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 389 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_spinlock.c:206: EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit
Verified recommended fix
Source-confirmed at sys/kern/kern_spinlock.c:206: EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit
Verdict
Source-confirmed at sys/kern/kern_spinlock.c:206: EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit
No comments yet.