DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2523

trm_Reselect spins forever (no exit) if reselected target/LUN does not match any DCB - interrupt-context DoS

Summary

trm_Reselect walks circular DCB list looking for DCB whose TargetID/LUN matches reselected ID. If no DCB matches (malicious/misbehaving SCSI device reselects with never-enumerated ID/LUN) while loop has no escape spins at interrupt context hanging CPU freezing all interrupt processing. DCB list circular no iteration counter no NULL/identity exit. Hardware already accepted reselection only way out bus reset.

Discussion (0)

No comments yet.