DF-0210
clist_catq infinite loop on aliasing (cls==cld)
Summary
clist_catq(:294-301) if cls==cld: getc removes head, putc appends tail, queue never empties -> livelock. Also putc return ignored (silent data drop when full). No in-tree caller passes same clist.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0210 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | clist_catq infinite loop on aliasing (cls==cld) | 218 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/tty_subr.c:294: clist_catq infinite loop on aliasing (cls==cld)
Verified recommended fix
Source-confirmed at sys/kern/tty_subr.c:294: clist_catq infinite loop on aliasing (cls==cld)
Verdict
Source-confirmed at sys/kern/tty_subr.c:294: clist_catq infinite loop on aliasing (cls==cld)
No comments yet.