cv_destroy performs no waiters/queued-state validation — destroy-with-waiter goes undiagnosed, leaving a stale wchan in td_wchan (divergence from FreeBSD INVARIANTS probe)
| Field | Value |
|---|---|
| ID | DF-2986 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-667 (missing diagnostic assertion) |
| File | sys/kern/kern_condvar.c |
| Lines | 14-18 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
cv_destroy only calls spin_uninit, which is a no-op. It carries no INVARIANTS-mode assertion that no thread is still blocked on — or interlocked-enqueued against — the cv being destroyed. FreeBSD's cv_destroy asserts under INVARIANTS that the associated sleep queue is empty. In the ~100 in-tree consumer files (several user-reachable: /dev/cuse, u4b, drm, ipmi, wlan scan), a destroy-with-live-waiter bug therefore produces no diagnostic at all: the waiter keeps the freed cv pointer as td_wchan, hangs silently (timo=0 cv_wait sleeps forever), and after KVA reuse the stale identity can cross-wake unrelated sleepers at the same address. No memory-safety impact today — _wakeup matches by pointer identity only and never dereferences, and spin_uninit writes nothing — a defense-in-depth/diagnostics divergence. Fix: INVARIANTS empty-check via a kern_synch helper probing gd_tsleep_hash (bare KASSERT(cv_waiters==0) is NOT correct — ghost counts from timeouts are legitimate).
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_condvar.c (GLM 5.3). Protocol otherwise proven sound (interlock/latch/ghost accounting all killed with citations).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2986 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 223 B | ↓ raw | |
| cv2986.c | — | 1.6 KB | view raw | |
| fix.diff | — | 1.8 KB | view raw | |
| manifest.json | — | 400 B | view raw | |
| run.log | — | 292 B | view raw | |
| verdict.json | — | 1.7 KB | view raw |
DF-2986 evidence pack
What
cv_destroy performs no waiters/queued-state validation
Verdict
status=reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablecompiled in the F40FIX INVARIANTS build (helper tsleep_wchan_busy in kern_synch.c + probe in cv_destroy). Runtime trip not executed (would panic the shared verification kernel); the stock-side missing-diagnostic behavior is what was demonstrated live.
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a
Verified recommended fix
INVARIANTS-gated cv_destroy waiter probe via tsleep_wchan_busy() (kern_synch.c)
Verdict
Reproduced mechanically with a KMOD probe on the stock INVARIANTS guest: a kernel thread was parked in cv_wait (cv_waiters==1, thread blocked), then cv_destroy returned with ZERO diagnostics (spin_uninit is a no-op, spinlock2.h:308-312), and the stale cv identity still woke the waiter afterwards (cv2986 KMOD log). FreeBSDs cv_destroy asserts an empty sleep queue under INVARIANTS; DragonFly has no probe. No memory-safety impact today (_wakeup matches by pointer identity only). Fix: INVARIANTS-gated probe via new tsleep_wchan_busy() helper scanning gd_tsleep_hash; compiled in the F40FIX build.
No comments yet.