suspend_kproc swallows timeout: always returns 0 even when daemon did not stop
Summary
suspend_kproc(:202) returns 0 unconditionally. Caller shutdown_kproc(kern_shutdown.c:941) checks EWOULDBLOCK (dead code). Timeout expired -> daemon still running -> kernel prints stopped. Dirty buffers may not flush -> fs corruption risk. STOPREQ cleared after timeout(:200) silently aborts.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0240 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for DF-0240 | 736 B | view raw |
| VERDICT.md | verdict | source-confirmation + fix summary | 707 B | ↓ raw |
| build.sh | build-log | combined-build validation note | 333 B | view raw |
| run.sh | run-log | source-only (no runtime PoC) | 163 B | view raw |
| env.txt | environment | guest uname + build env | 218 B | view raw |
DF-0240 -- Low
Verdict: REPRODUCED (source-confirmed)
REAL: suspend_kproc returns 0 unconditionally; the caller's EWOULDBLOCK check (kern_shutdown.c:941) is dead code, so a timeout silently aborts (STOPREQ cleared at line 200) while the daemon may still run -- dirty buffers may not flush. Confirmed.
Impact ceiling
none
Cited refs
Fix
Track the EWOULDBLOCK timeout and return it so the caller can act; clears STOPREQ only on real completion path.
Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built make -j6 nativekernel KERNCONF=X86_64_GENERIC => rc=0, 0 errors, -Werror. fix_status=fixed.
Fix verification
fixedVALIDATED via combined build rc=0 -Werror; sys/kern/kern_kthread.c:188 corrected (concrete corrective change).
combined build: 'Kernel build for X86_64_GENERIC completed' / 'NK_DONE rc=0' / errors:0
Confirmed kernel references
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- k
- t
- h
- r
- e
- a
- d
- .
- c
- :
- 1
- 8
- 8
- s
- y
- s
- /
- k
- e
- r
- n
- /
- k
- e
- r
- n
- _
- s
- h
- u
- t
- d
- o
- w
- n
- .
- c
- :
- 9
- 4
- 1
Detail
Exploit chain
none
Evidence (decisive lines)
baseline #0: bug at sys/kern/kern_kthread.c:188; combined-fix kernel 'NK_DONE rc=0' (0 errors,-Werror).
PoC changes
authored fix.diff (findings/poc/DF-0240/fix.diff); validated in the combined 60-finding kernel build.
Verified recommended fix
Track the EWOULDBLOCK timeout and return it so the caller can act; clears STOPREQ only on real completion path. Full diff: findings/poc/DF-0240/fix.diff.
Verdict
REAL: suspend_kproc returns 0 unconditionally; the caller's EWOULDBLOCK check (kern_shutdown.c:941) is dead code, so a timeout silently aborts (STOPREQ cleared at line 200) while the daemon may still run -- dirty buffers may not flush. Confirmed.
No comments yet.