DF-4394
hpt_shutdown_vbus frees LDM memory and adapter handles before terminating the vbus timer callout - pending timer callback runs on freed memory (shutdown-window UAF)
Summary
In the shutdown path the vbus lock is dropped, LDM command pools are freed and adapter handles kfree'd, but the periodic vbus timer (callout_init_lk'd to the vbus lock, armed for background RAID/rebuild tasks) is only terminated AFTERWARDS. A timer callback firing in the window executes LDM code over freed command structures. Shutdown-time crash when a rebuild/verify has the timer armed. Terminate-before-free fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4394 Β· 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | β raw | |
| verdict.json | file | 845 B | view raw |
README.md
file
β download raw
DF-4394
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
see pass-2 result block fix
source-only
per-fix-DF-4394
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; hardware-gated
No comments yet.