Uninterruptible multi-second waits and 750ms DELAY busy-spin held under dev_lock in the TIS transmit path (DF-1991's TIS twin plus a new busy-wait): 40s unkillable sleep for user-chosen Create* command codes, ~750ms+ CPU spin per burst on a stalled TPM
Summary
dev_lock held across a 750,000-iteration DELAY(1)+MMIO busy-spin per burst chunk AND PCATCH-less tsleeps up to the command timeout - which is selected from the fully user-chosen command code: Create* codes pin the thread unkillable for 40s under dev_lock, starving all cdev users and shutdown. TIS twin of DF-1991 + the new busy-spin. PCATCH + yield-polling fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4860 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
root writes a Create*-coded command against a stalled TPM -> 40s unkillable D-state under dev_lock + ~750ms CPU spin per burst -> cdev and shutdown starvation
Evidence (decisive lines)
findings/poc/DF-4860/ (this verdict)
Verdict
Hardware-gated: the TIS transmit path holds dev_lock exclusively and (1) busy-spins up to 750,000 DELAY(1)+MMIO iterations per burst chunk in wait_for_burst (~750ms+ CPU, multiplied by alternating burst=0 stalls), and (2) tsleeps WITHOUT PCATCH for up to the command timeout - which tpm20_get_timeout selects from the FULLY USER-CHOSEN command code: any TPM_CC_Create/CreatePrimary/CreateLoaded pins the thread unkillable in D-state for 40s while holding dev_lock, starving all other /dev/tpm0 users and shutdown. The TIS twin of DF-1991 plus the new busy-spin detail. Root/wheel cdev or hostile TPM. PCATCH + yield-style burst polling fix.
No comments yet.