DF-0215
Wait-counter inc/dec can overflow into control bits (theoretical)
Summary
Wait counter bits 0-29. atomic_intr_cond_inc/dec are plain incl/decl on full word. ~1.07e9 waiters -> carry into bit 30 (handler-disabled) or 31 (lock-held). Not achievable: max CPUs 256, each contributes 1 outstanding inc.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0215 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 391 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/lwkt_serialize.c:271: wait-counter inc/dec can overflow into control bits (theoretical)
Verified recommended fix
Source-confirmed at sys/kern/lwkt_serialize.c:271: wait-counter inc/dec can overflow into control bits (theoretical)
Verdict
Source-confirmed at sys/kern/lwkt_serialize.c:271: wait-counter inc/dec can overflow into control bits (theoretical)
No comments yet.