DF-0192
Concurrent writer/reader cursor updates on msg_bufl unsynchronized
Summary
msg_bufl written by logread(:185) and msgaddchar(subr_prf.c:1064) with no atomic/lock. cpu_ccfence is compiler barrier only. Lost update -> duplicated/skipped log lines. No OOB (modular indexing bounds uiomove). Data integrity only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0192 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 385 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/subr_log.c:153: concurrent writer/reader cursor updates on msg_bufl unsynchronized
Verified recommended fix
Source-confirmed at sys/kern/subr_log.c:153: concurrent writer/reader cursor updates on msg_bufl unsynchronized
Verdict
Source-confirmed at sys/kern/subr_log.c:153: concurrent writer/reader cursor updates on msg_bufl unsynchronized
No comments yet.