DF-2523
trm_Reselect spins forever (no exit) if reselected target/LUN does not match any DCB - interrupt-context DoS
Summary
trm_Reselect walks circular DCB list looking for DCB whose TargetID/LUN matches reselected ID. If no DCB matches (malicious/misbehaving SCSI device reselects with never-enumerated ID/LUN) while loop has no escape spins at interrupt context hanging CPU freezing all interrupt processing. DCB list circular no iteration counter no NULL/identity exit. Hardware already accepted reselection only way out bus reset.
No comments yet.