kthread_park() returns the wrong value (ts->kt_exitvalue instead of a success code)
Summary
In Linux kthread_park() returns 0 on success negative errno on failure. DragonFly shim instead returns ts->kt_exitvalue which is kthread function exit code (always 0 until thread actually exits then whatever int thread returned). Semantically wrong misleads any future caller checking return value. No current caller inspects return (amdgpu_debugfs.c:868 amdgpu_device.c:3412 both ignore it) so impact today nil. kt_exitvalue only assigned by linux_ktfn_wrapper when kthread function returns i.e. never during park request thread expected to honor while still alive. Latent bug ported driver doing if(kthread_park(t)<0) handle_error() would mishandle path. Defense-in-depth only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2197 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 706 B | ↓ raw | |
| fix.diff | file | 164 B | view raw |
DF-2197 - Verification Verdict
Status: reproduced (source-confirmed) Impact: none Confidence: certain
Verdict
Source-confirmed: kthread_park (:109) returns ts->kt_exitvalue instead of 0/negative-errno per Linux API; wrong return semantics; DRM-module-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
kthread_park returns kt_exitvalue not errno; DRM-gated
Verified recommended fix
kthread_park returns kt_exitvalue not errno; DRM-gated
Verdict
kthread_park returns kt_exitvalue not errno; DRM-gated
No comments yet.