β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5609

cothread_create/cothread_delete ignore pthread_create()/pthread_join() failure β€” EAGAIN leaves a registered virtual interrupt, a NULL pthread handle, and undefined pthread_kill/pthread_join on it

Summary

pthread_create's return is unchecked: on EAGAIN the M_ZERO'd cotd->pthr stays NULL while thr_intr remains registered on virtual IRQ 1 and the caller believes it has a working cothread - every later cothread_intr does pthread_kill(NULL) and delete does pthread_join(NULL) (undefined per libthread_xu, likely host-process crash), and the cotd leaks. Host-level thread exhaustion (RLIMIT_NPROC pressure from an unprivileged user on a shared host) converts a recoverable EAGAIN into a vkernel crash or silently dead device channel. check+unwind fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5609 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.1 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5609

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace with path:line

Verified recommended fix

check pthread returns + unwind (5609); single-writer wakeup handshake (5610)

Verdict

untested (Low robustness/latency class; PoC skipped per contract - reproduction sketch in the finding)