DF-4513
vmbus: vmbus_msghc_wait_result blocks uninterruptibly with no timeout - a silent or malicious Hyper-V host permanently wedges device attach at boot (and later wedges vmbus_msghc_ctx_destroy/kldunload too)
Summary
wait_result spins in an uninterruptible timeout-less tsleep; vmbus_init calls it from attach for every offered protocol version - a host that never injects VERSION_RESP leaves boot asleep forever with zero console output. The same wait is inherited by get1, so later teardown also hangs: sticky wedge, no recovery short of hard reset. Availability twin of DF-1668 under the malicious-host model. Bounded-wait+ECOMM fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4513 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1004 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
not_testable: Hyper-V/ath hardware absent from guest
fix in finding markdown
per-fix-DF-4513
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Uninterruptible tsleep(0) in wait_result reached from attach for every protocol version; the same wait later wedges ctx_destroy/kldunload. Bounded-wait + ECOMM fix.
Verdict
not_run: requires a Hyper-V host that withholds VERSION_RESP (untrusted-cloud scenario)
No comments yet.