DF-4481
complete_rqe() raw-plex error path never biodone's the user bio nor frees the request — permanent unkillable I/O hang plus locked-buf/pbuf leak per errored plex I/O
Summary
When a raw-plex request finishes with error, the isplex branch sets B_ERROR/b_error and returns without biodone(ubio) or freerq(rq) (the success branch does both). The issuer sleeps forever with no timeout and no PCATCH (unkillable D-state); every rq leaks its BUF_LOCKed rqe buffers, malloced parity/data buffers and a pbuf - repeated errors exhaust the pbuf pool system-wide. Found during the vinumrequest.c pass-2 (defect lives in vinuminterrupt.c). Operator/root-gated or genuine hardware failure. Two-line biodone+freerq fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4481 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 927 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
fix in finding markdown
per-fix-DF-4481
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Found during the vinumrequest.c pass-2 (cross-file: the isplex error branch lives in vinuminterrupt.c). biodone+freerq fix in finding markdown.
Verdict
not_run: md devices on guest cannot be made to fail I/O (no failure-injection facility); two-line certainty by inspection
No comments yet.