DF-4571
missed_breadcrumb() forces intel_engine_dump() unconditionally ('|| 1' debug leftover): full engine state dump, including the DF-4246 over-reading ring hexdump path, runs from callout context every hangcheck period on production kernels
Summary
The '|| 1' is a port-local edit (upstream: plain GEM_SHOW_DEBUG(), which is 0 in production). Every missed-breadcrumb event - from the 1.5s hangcheck timer per affected engine - executes the heavyweight intel_engine_dump from softclock context regardless of debug settings: unthrottled multi-KB console/dmesg flooding plus repeated entry into the DF-4246 over-read path. Unpriv-triggerable (missed-irq syndrome under load). Drop-the-||-1 fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4571 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 959 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
not_testable: no Intel GPU on guest
fix in finding markdown
per-fix-DF-4571
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Port-local '|| 1' debug leftover (upstream: plain GEM_SHOW_DEBUG()). Unpriv workload with missed-irq syndrome triggers it. Drop-the-||-1 fix.
Verdict
not_run: Low severity + no Intel GPU on guest
No comments yet.