DF-0168
Lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
Summary
sysref_alloc(:142-148) lazily inits srclass->oc with plain NULL-check+store, no lock. Two CPUs first-alloc same class -> two objcaches created, second wins. First leaked. Objects may cross caches via objcache_put at free time. Boot ordering mitigates (most classes single-threaded at first alloc).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0168 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 387 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_sysref.c:142: lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
Verified recommended fix
Source-confirmed at sys/kern/kern_sysref.c:142: lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
Verdict
Source-confirmed at sys/kern/kern_sysref.c:142: lazy objcache creation in sysref_alloc is racy (no lock on srclass->oc init)
No comments yet.