DF-0242
TOCTOU: td_proc NULL check without holding kpsus_token
Summary
suspend_kproc(:190) checks td->td_proc==NULL BEFORE acquiring kpsus_token(:191). Token guards flags but not type-check guard. Safe for pure kernel threads (td_proc permanently NULL). Defense-in-depth.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0242 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 388 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/kern/kern_kthread.c:190: TOCTOU - td_proc NULL check without holding kpsus_token
Verified recommended fix
Source-confirmed at sys/kern/kern_kthread.c:190: TOCTOU - td_proc NULL check without holding kpsus_token
Verdict
Source-confirmed at sys/kern/kern_kthread.c:190: TOCTOU - td_proc NULL check without holding kpsus_token
No comments yet.