DF-0225
Implicit undocumented locking contract on lwp_rtprio writes
Summary
ksched_setscheduler writes lp->lwp_rtprio(:175,:184) with no lock/assert. Correctness depends on caller holding lwp_token(kern_p1003_1b.c:208,234,264). Contract undocumented. Future caller missing token -> torn write -> inconsistent type/prio.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0225 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 387 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_sched.c:175: implicit undocumented locking contract on lwp_rtprio writes
Verified recommended fix
Source-confirmed at sys/kern/kern_sched.c:175: implicit undocumented locking contract on lwp_rtprio writes
Verdict
Source-confirmed at sys/kern/kern_sched.c:175: implicit undocumented locking contract on lwp_rtprio writes
No comments yet.