FOFFSETLOCK acquisition sleeps uninterruptibly ('fpoff', no PCATCH): a thread wedged forever inside VOP_READ while holding the offset lock makes every other thread sharing the file descriptor permanently unkillable
| Field | Value |
|---|---|
| ID | DF-2758 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-667 Improper Locking (unkillable sleep) |
| File | sys/kern/vfs_vnops.c |
| Lines | 569-581 (lock held across VOP at :750-758/:802-811) |
| Area | kern |
| Confidence | speculative |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
vn_get_fpf_offset blocks on FOFFSETLOCK via tsleep with no PCATCH, no timeout. The lock is held across the entire VOP_READ/VOP_WRITE. If the holder blocks uninterruptibly inside the FS (hard-mounted NFS read against a dead server, wedged device), every other thread sharing the fp (fork, SCM_RIGHTS) sleeps unkillably in 'fpoff' forever — amplification of any storage hang into a permanent unkillable-D-state process leak. FIFO/device reads are signal-interruptible and release the lock on ERESTART, so the stock guest cannot demonstrate it — speculative.
Recommended fix
tsleep(&fp->f_flag, PINTERLOCKED | PCATCH, "fpoff", 0) and return
EINTR/ERESTART on signal (callers already release the lock on all
return paths).
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_vnops.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2758 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 1.3 KB | view raw |
Fix verification
not_testablePCATCH mitigation compile-validated; complete fix needs an error-return API change; not demonstrable on this guest.
compile-validated in the fix-all kernel build (make nativekernel, 0 errors)
Confirmed kernel references
Detail
Evidence (decisive lines)
vfs_vnops.c:575 tsleep(..., PINTERLOCKED, "fpoff", 0) - no PCATCH/timeout
PoC changes
n/a
Verified recommended fix
--- sys/kern/vfs_vnops.c 2026-06-29 12:51:19.000000000 +0000
Verdict
Code-verified uninterruptible wait; not demonstrable on the stock guest, exactly as the finding predicts. vn_get_fpf_offset (sys/kern/vfs_vnops.c:569-582) tsleeps on fp->f_flag with PINTERLOCKED only - no PCATCH, no timeout - while the FOFFSETLOCK holder runs a whole VOP_READ/WRITE. A holder blocked uninterruptibly inside the filesystem (dead NFS server) would wedge every fd-sharing thread in fpoff forever. Every storage backend available on this guest (hammer2 root, UFS /boot, tmpfs, devfs) is either local or interruptible, so no holder can be parked indefinitely to stage the wedge. The finding itself marks this speculative. The mitigation patch (PCATCH + yield) is compile-validated; a complete fix needs an error-return path in vn_get_fpf_offset (API change).
No comments yet.