DF-5609
cothread_create/cothread_delete ignore pthread_create()/pthread_join() failure β EAGAIN leaves a registered virtual interrupt, a NULL pthread handle, and undefined pthread_kill/pthread_join on it
Summary
pthread_create's return is unchecked: on EAGAIN the M_ZERO'd cotd->pthr stays NULL while thr_intr remains registered on virtual IRQ 1 and the caller believes it has a working cothread - every later cothread_intr does pthread_kill(NULL) and delete does pthread_join(NULL) (undefined per libthread_xu, likely host-process crash), and the cotd leaks. Host-level thread exhaustion (RLIMIT_NPROC pressure from an unprivileged user on a shared host) converts a recoverable EAGAIN into a vkernel crash or silently dead device channel. check+unwind fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5609 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5609
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace with path:line
Verified recommended fix
check pthread returns + unwind (5609); single-writer wakeup handshake (5610)
Verdict
untested (Low robustness/latency class; PoC skipped per contract - reproduction sketch in the finding)
No comments yet.