Recursive drm_modeset_lock (same ctx, same lock) double-tracks and corrupts ww accounting: ctx->acquired off-by-one leak, ww->ctx/ww->stamp cleared while lock still held, latent lockmgr LK_RELEASE panic
Summary
The DFly ww shim never returns -EALREADY (LK_CANRECURSE recurses silently), and the tracking block runs on every ret==0 - each same-ctx recursive acquire double-tracks; the first unlock clears ww->ctx while still held and the second skips the decrement, leaving the ctx believing it holds a lock while holding none (spurious EDEADLK, ww-invariant violation, retry churn). ROUTINE: the atomic-check pass locks connection_mutex twice with the same ctx. Latent trap for the eventual shim fix (would double-unlock/panic). Skip-if-already-tracked fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4920 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.5 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
MODE_ATOMIC forcing a modeset -> same-ctx recursive connection_mutex lock -> acquired skew -> spurious EDEADLK/backoff churn mid-ioctl
Evidence (decisive lines)
findings/poc/DF-4920/ (this verdict)
Verdict
Protocol-accounting degradation (no panic/corruption/hang as shipped; Low): modeset_lock normalizes -EALREADY to 0 BEFORE the unconditional tracking block, and the DFly ww shim never returns -EALREADY (LK_CANRECURSE lockmgr silently recurses for same-ctx relock and returns 0) - so every recursive acquire double-tracks: a second info on both lists, ctx->acquired +1, ww->ctx/stamp overwritten. The first unlock clears ww->ctx while the hold-count is still >0; the second skips the decrement - the ctx permanently believes it holds a lock while holding none, taking the contended path with zero locks (spurious EDEADLK, violating the ww invariant; retry churn). REACHED ROUTINELY: drm_atomic_get_connector_state + add_affected_connectors both lock connection_mutex with the same ctx in one atomic pass. LATENT TRAP: if the shim is ever fixed to Linux -EALREADY semantics, this code double-unlocks -> kern_lock panic. Skip-tracking-if-already-tracked fix.
No comments yet.