DF-0172
mpipe_free reads/writes mpipe->pending outside the lwkt_token
Summary
mpipe_free(:355/:358) releases token, then reads/clears mpipe->pending(:363-365) + wakeup. mpipe_alloc_waitok sets pending=1 UNDER token(:324). Inconsistent: pending written under-token by waiter, read/cleared off-token by freer. On x86 TSO no lost-wakeup (retry loop tolerates spurious). Latent portability concern for weak-memory models.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0172 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_mpipe.c:344: mpipe_free reads/writes pending outside the lwkt_token
Verified recommended fix
Source-confirmed at sys/kern/kern_mpipe.c:344: mpipe_free reads/writes pending outside the lwkt_token
Verdict
Source-confirmed at sys/kern/kern_mpipe.c:344: mpipe_free reads/writes pending outside the lwkt_token
No comments yet.