DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2378

HT-sibling C-state copy in acpi_cst_cx_probe_cst writes another CPU live softc without synchronization

Summary

When CPU _CST reprobe decides HT siblings on same core have inconsistent C-state count it calls acpi_cst_copy(dst_sc src_sc) where dst_sc is SIBLING CPU softc. acpi_cst_copy updates dst_sc->cst_cx_count then memcpys entire cst_cx_states array. Sibling idle thread runs concurrently on sibling CPU (its PROBING flag NOT set so idle guard does not deflect) and may observe torn cst_cx_states array including partially-written enter function pointer leading to wild-pointer indirect call at acpi_cst_idle cx_next->enter kernel panic. Source CPU PROBING flag correctly blocks source idle thread but sibling PROBING flag never set by this code path.

Discussion (0)

No comments yet.