DF-4979

SSIF READ_START retry loop retries ENXIO/EBUSY forever — unbounded kthread livelock DoS via stuck/malicious BMC (distinct site from DF-2026)

Summary

goto read_start retries ENXIO/EBUSY with no cap (a different loop from DF-2026's for(;;)) - a stuck BMC wedges the kthread inside one request, all IPMI ioctls block forever and the watchdog callout stops. Bounded-retry fix.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-835
File: sys/dev/misc/ipmi/ipmi_ssif.c
Lines: 186-194
Area: dev
Discovered: 2026-09-25
Updated: 2026-09-25

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: dos
Confidence: certain
Tested: 2026-09-25 14:58:38
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-09-25 14:58:38
Runtime: —
Kernel: per-fix-DF-4979
fix.diff: findings/poc/DF-4979/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4979 · 1 files

File	Type	Description	Size
verdict.json	file		931 B	view raw

Fix verification

not_testable

per-fix-DF-4979

Confirmed kernel references

Detail

Exploit chain

BMC at the SSIF address answers READ_START with persistent EBUSY -> goto read_start loop never exits -> IPMI subsystem stall + watchdog neglect

Evidence (decisive lines)

findings/poc/DF-4979/ (this verdict)

Verdict

Distinct unbounded loop from DF-2026 (verified not fixed by a DF-2026 cap): on ENXIO/EBUSY from the first SMBus block read the code releases the bus, sleeps 10ms, and 'goto read_start' retries forever - a stuck/malicious BMC (or SMBus controller fault) wedges the ssif kthread inside one request: queued+future IPMI ioctls block forever and the watchdog callout stops being serviced. Bounded-retry fix (~1s cap).