Summary

wait_on_bit_timeout() timeout-expiration test time_after_eq(start_time timeout) at linux_wait.c:121 compares start_time (absolute ticks value captured at entry e.g. ~10^6 after hours uptime) against timeout (RELATIVE duration in jiffies supplied by caller e.g. 1 for i915 GPU-reset handoff). time_after_eq(a,b) = ((long)(b)-(long)(a)<=0) = b<=a so timeout<=start_time is true on first iteration for ANY system up longer than timeout jiffies. Function returns 1 (timed out bit still set) after sleeping exactly one tsleep interval regardless of actual bit state. Wait semantics completely broken. Author intended time_after_eq(ticks start_time+timeout). Reachable: unprivileged local user with i915 /dev/dri access submits GPU batch that hangs engine forces reset path. i915_irq.c:3194-3202 do/while loop calls i915_reset() re-tests via wait_on_bit_timeout(...1). Function returns 1 after ~1 jiffie every iteration loop degenerates into 100Hz polling repeatedly invoking i915_reset on already-resetting GPU. Impact: sustained CPU consumption local DoS; repeated GPU reset races legitimate progress; corrupted GPU error/recovery state handoff protocol violated.