DF-4433
sln_mii_cmd() busy-waits on SL_MIISTAT_BUSY with no timeout while holding the interface serializer — unprivileged SIOCGIFMEDIA turns a wedged PHY/PCI readback into a permanent serializer-held kernel busy loop
Summary
Two unbounded do/while DELAY(10) polls with no retry limit. SIOCGIFMEDIA requires NO privilege and runs under ifnet_serialize_all; sln_media_intr runs the same loop in hard-interrupt context. Stuck-BUSY (wedged PHY, D3 after suspend, MMIO fault readback 0xffffffff bit31) spins the thread forever holding the serializer - permanent interface DoS + pegged CPU. Unprivileged ioctl reachability proven on guest generically. Bounded-poll fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4433 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated
fix.diff in finding markdown
per-fix-DF-4433
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Unbounded do/while DELAY(10) polls with no retry limit under ifnet serializer and in intr context. Bounded-poll fix in finding markdown.
Verdict
not_run: trigger needs SC92031 hw with wedged MII (absent in guest); unprivileged SIOCGIFMEDIA reachability of the generic dispatch demonstrated on guest (uid=1001 ifconfig media query)
No comments yet.