DF-4530
vchan_trigger commits trigger state and parent busy-list membership before chn_notify() and never rolls back on failure, enabling a masked-retry fake-running channel (per-fd wedge)
Summary
trigger state and busy-list membership are committed BEFORE the fallible chn_notify() and never rolled back on its failure; a retried START then short-circuits at the go==info->trigger early return reporting success while the parent hardware never started - the dsp fd wedges (writes block forever, poll never fires) until close. chn_trigger's own bookkeeping desynchronizes. List membership stays paired with info->trigger throughout - state-machine integrity bug and per-fd DoS, not memory corruption. Precondition: an audio driver trigger/reset failure. Rollback-on-notify-failure fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4530 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
rollback-on-notify-failure diff in finding markdown
per-fix-DF-4530
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
trigger state and busy-list membership committed before the fallible chn_notify and never rolled back; the masked-retry early return then reports success while the parent hardware never started. Deterministic triggering needs an audio driver whose CHANNEL_TRIGGER fails on demand - no guest codec provides that. Busy-list membership paired throughout => walkers never see stale/double-linked entries.
Verdict
not_run: Low state-machine DoS, no deterministic unpriv trigger on guest
No comments yet.