DF-0214
handler_disable discards in-flight indicator from atomic_intr_handler_disable
Summary
atomic_intr_handler_disable returns bit 31 (handler in-flight). lwkt_serialize_handler_disable(:150-153) discards return. Callers get no drain guarantee. Worked around by HW mask + serializer hold. API design gap.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0214 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/lwkt_serialize.c:149: handler_disable discards in-flight indicator
Verified recommended fix
Source-confirmed at sys/kern/lwkt_serialize.c:149: handler_disable discards in-flight indicator
Verdict
Source-confirmed at sys/kern/lwkt_serialize.c:149: handler_disable discards in-flight indicator
No comments yet.