DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2470

Infinite loop in response-queue pointer update when target mode advances the output index

Summary

After isp_handle_other_response() may update response-queue output pointer code uses while(tsto!=oop) loop whose body only reassigns optr and never modifies either loop variable. If pointer advanced (tsto!=oop) loop never terminates hanging interrupt service context. tsto initialized to oop only isp_handle_other_response can change it. Loop body assigns optr from tsto but neither tsto nor oop modified inside loop condition invariant. Requires kernel built with ISP_TARGET_MODE (commented out by default).

Discussion (0)

No comments yet.