DF-4656
Bounce-buffer kmalloc failure path drops the ccb (xpt_done never called) — CAM devq wedge under memory pressure
Summary
Completion is gated on the FAILED flag which the ENOMEM bounce-buffer path never sets and whose callback never ran - error!=0 skips xpt_done while twa_action frees the request: the ccb stays CAM_SIM_QUEUED forever, each occurrence permanently consuming one devq slot until all I/O to the controller wedges. Complete-on-any-map-error fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4656 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 946 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable: no 3ware hardware on guest
fix in finding markdown
per-fix-DF-4656
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Completion gated on the FAILED flag which the ENOMEM bounce-buffer path never sets and the callback never runs - error!=0 skips xpt_done while the request is freed. Complete-on-any-error fix.
Verdict
not_run: needs 3ware hardware + memory pressure + unaligned I/O; trace-certain
No comments yet.