DF-0213
last_td tracking field uses non-atomic plain load/store racy on SMP
Summary
s->last_td plain stores(:112,:127,...) read in ASSERT_SERIALIZED(serialize.h:60). No barrier vs atomic bit. last_td set -2 BEFORE atomic release(:139). Stale/torn on SMP -> false assertion results. Debug-only no production impact.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0213 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/lwkt_serialize.c:112: last_td tracking uses non-atomic plain load/store racy on SMP
Verified recommended fix
Source-confirmed at sys/kern/lwkt_serialize.c:112: last_td tracking uses non-atomic plain load/store racy on SMP
Verdict
Source-confirmed at sys/kern/lwkt_serialize.c:112: last_td tracking uses non-atomic plain load/store racy on SMP
No comments yet.