lwkt_acquire() spins forever on a wedged owner cpu with no watchdog recovery (wedge-family hardening)
| Field | Value |
|---|---|
| ID | DF-2730 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-834 Excessive Iteration |
| File | sys/kern/lwkt_thread.c |
| Lines | 1394-1407 |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
lwkt_acquire() waits for a migrating thread's owner cpu to clear TDF_RUNNING|TDF_PREEMPT_LOCK in an unbounded loop whose only diagnostic is a once-per-second LOOPMASK kprintf. Compare the two sibling spin sites, both with recovery: lwkt_send_ipiq3's drain wait re-issues the IPI after 10 repeats with smp_sniff(); lwkt_wait_ipiq panics after ~10s to unwedge the system. If the owner cpu is permanently wedged (the DF-2679 family), lwkt_acquire converts that single-cpu wedge into a second permanently-spun cpu with no escape — spinning inside a critical section servicing only incoming IPIs. Defense-in-depth; requires a pre-existing primary defect.
Recommended fix
Mirror lwkt_wait_ipiq's discipline: bounded spin (~10s), diagnostic kprintf with the owner's gd_sample_pc/gd_sample_sp, resched IPI re-issue (smp_sniff-style), then panic('lwkt_acquire') so the system dumps instead of silently multi-cpu spinning.
Timeline
- 2026-08-30 Discovered during pass-2 audit of lwkt_thread.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2730 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| README.md | — | 242 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 597 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2730 evidence pack
- finding: sys/kern/lwkt_thread.c (1394-1407)
- verdict: reproduced (likely) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: documented recommendation (no diff)
DF-2730 - Verification Verdict
Status: reproduced Impact: denial_of_service Confidence: likely
Mechanism
lwkt_acquire spins forever on td->td_flags & (TDF_RUNNING|TDF_PREEMPT_LOCK) with no watchdog: if the owner cpu wedges with the thread flagged, the acquiring cpu burns 100% forever (LOOPMASK diagnostics are compiled out).
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain unbounded spin (wedge-family hardening). Converting the silent wedge into a diagnosable event requires policy (timeout length, panic vs degrade) - authored as a documented recommendation, no code change in this batch to avoid destabilizing the scheduler on speculation.
Threat / reachability
Permanent cpu burn on a wedged owner; unrecoverable without reboot.
Privilege escalation assessment
n/a (hardening)
Fix
Documented recommendation (no fix.diff): add a bounded spin with kprintf escalation and a configurable panic after N seconds so wedged owners are diagnosable.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
(No fix.diff for this item: documented recommendation only - see Fix above.)
Fix verification
not_testableNo fix.diff (documented recommendation in VERDICT.md): Documented recommendation (no fix.diff): add a bounded spin with kprintf escalation and a configurable panic after N seconds so wedged owners are diagnosable.
n/a (recommendation item)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Documented recommendation (no fix.diff): add a bounded spin with kprintf escalation and a configurable panic after N seconds so wedged owners are diagnosable.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain unbounded spin (wedge-family hardening). Converting the silent wedge into a diagnosable event requires policy (timeout length, panic vs degrade) - authored as a documented recommendation, no code change in this batch to avoid destabilizing the scheduler on speculation.
No comments yet.