DF-4627
mipi_exec_delay: VBT-controlled u32 delay becomes a kernel BUSY-WAIT of up to ~71.6 minutes per element (arbitrarily many elements)
Summary
A fully VBT-controlled u32 goes to usleep_range which the DF shim implements as DELAY(min) - a busy-wait, unlike Linux which sleeps. Up to ~71.6 minutes of CPU spin per element, repeatable across unlimited elements, in the panel enable paths holding DRM locks so all other clients block. Cap-500ms + sleep-in-steps fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4627 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 963 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: hardware-gated (no Intel DSI panel / no mpt HBA on guest)
fix in finding markdown
per-fix-DF-4627
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
VBT-controlled u32 delay becomes a kernel BUSY-WAIT because the DF shim's usleep_range is DELAY(min). Cap-500ms + sleep-in-steps fix.
Verdict
not_run: no Intel GPU on guest; u32 -> DELAY(min) busy-wait is code-proven (delay.h:47-51)
No comments yet.