β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5610

cothread_wakeup()'s vktimer_ts zeroing races vktimer_thread's reload store β€” wakeup can be silently consumed, delaying all systimers by up to the stale sleep

Summary

The zeroing-then-SIGINT 'latch' only covers the store->nanosleep-entry window in one direction: if the thread's vktimer_ts store lands after the waker's zeroing while SIGINT is delivered during the rescan, the empty handler consumes the signal AND the zeroing is overwritten - the cothread sleeps the stale-long value and every systimer on every cpu is delayed by up to that value (<=1s, bounded by the reload clamp). Transient hard-timer latency spikes under reload pressure; adjacent to DF-5568 (dead CAS in the same protocol). Single-writer handshake fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5610 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.1 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5610

Confirmed kernel references

Detail

Evidence (decisive lines)

static trace with path:line

Verified recommended fix

check pthread returns + unwind (5609); single-writer wakeup handshake (5610)

Verdict

untested (Low robustness/latency class; PoC skipped per contract - reproduction sketch in the finding)