DF-5388
No bus arbitration across transactions: serializer is dropped during RX waits, so concurrent smbus callers interleave inside one transfer
Summary
zsleep atomically releases sc->slz during RX waits and SMB_REQUEST_BUS is a stub returning 0: a second caller takes the serializer mid-A-transfer, resets rpos/rnext (discarding A's buffered data), possibly re-enables the controller, and A later consumes B's bytes as its own. Concurrent kernel users cross-deliver data (trackpad/sensor/SSIF). Real-REQUEST_BUS-exclusion fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5388 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5388
Confirmed kernel references
Detail
Evidence (decisive lines)
wire-level source proof vs SMBus 2.0 spec + ig4_reg.h documented abort/flush semantics
Verified recommended fix
see finding markdown
Verdict
untested (hardware-gated: no Intel LPSS I2C model in QEMU; pm SMBus is ichsmb, ACPI-injected fakes fail the COMP_VER gate)
No comments yet.