DF-4618
Uninterruptible multi-second busy-wait handshakes (VP0_LOW_SPINTMO=5,000,000 iterations) run under vpo_intr's critical section — malicious parallel-port device can pin a CPU against preemption per I/O
Summary
Every imm_wait runs a no-sleep busy-poll microseq (up to 5M iterations for data/status phases, ~2-6s at parport latency) and vpo_intr wraps the whole transaction in crit_enter - the issuing CPU cannot switch threads for the full duration. A malicious ZIP emulator simply never asserts nBUSY: worst-case tens of seconds of per-CPU preemption blackout per command, repeatable per I/O. The driver's stated threat model. No ppbus hardware on the guest. Cut-ceilings + sleepable-wait fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4618 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
cut spin ceilings 10x (short-term) + drop crit_Enter wrapper / sleepable wait (proper) in finding markdown
per-fix-DF-4618
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Every imm_wait runs a no-sleep busy-poll microseq (up to 5,000,000 iterations for data/status phases); vpo_intr wraps the whole synchronous transaction in crit_enter/crit_exit, so the issuing CPU cannot switch threads for the full duration. A malicious ZIP emulator simply never asserts nBUSY. Driver's stated threat model. No ppbus hardware on the guest.
Verdict
not_run: no ppbus hardware on guest; mechanism source-certain
No comments yet.