Unbounded hardware spin in tws_init_ctlr hangs kernel at device attach
Summary
tws_init_ctlr L100-109 while(1) reads TWS_I2O0_IOPOBQPH until controller returns TWS_FIFO_EMPTY32 no iteration cap no timeout no scheduling. Malicious/broken/partly-init PCIe device never returns FIFO-empty hangs entire kernel at probe/attach. Companion poll loops in same file (L392-402/L477-481) use TWS_LOCAL_TIME+TIMEOUT this one missed. tws_read_reg tws_services.c:186-198 wraps bus_space_read no internal bound. Attacker: hotplug/Thunderbolt/PCI-passthrough device vendor 0x13C1 device 0x1010 MMIO 0xDC never 0xFFFFFFFF. Impact: permanent host hang A:H. Fix: TWS_LOCAL_TIME+TWS_POLL_TIMEOUT return FAILURE.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1924 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 577 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 706 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1924 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: tws_init_ctlr L100-109 while(1) reads TWS_I2O0_IOPOBQPH until controller returns TWS_FIFO_EMPTY32 no iteration cap no timeout no scheduling. Malicious/broken/partly-init PCIe device never returns FIFO
Citation: sys/dev/raid/tws/tws_hdm.c:100-109
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unbounded while(1) FIFO drain hangs at attach (tws_hdm.c:100-109)
Verified recommended fix
Source-confirmed: unbounded while(1) FIFO drain hangs at attach (tws_hdm.c:100-109)
Verdict
Source-confirmed: unbounded while(1) FIFO drain hangs at attach (tws_hdm.c:100-109)
No comments yet.