DF-5610
cothread_wakeup()'s vktimer_ts zeroing races vktimer_thread's reload store β wakeup can be silently consumed, delaying all systimers by up to the stale sleep
Summary
The zeroing-then-SIGINT 'latch' only covers the store->nanosleep-entry window in one direction: if the thread's vktimer_ts store lands after the waker's zeroing while SIGINT is delivered during the rescan, the empty handler consumes the signal AND the zeroing is overwritten - the cothread sleeps the stale-long value and every systimer on every cpu is delayed by up to that value (<=1s, bounded by the reload clamp). Transient hard-timer latency spikes under reload pressure; adjacent to DF-5568 (dead CAS in the same protocol). Single-writer handshake fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5610 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.1 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5610
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace with path:line
Verified recommended fix
check pthread returns + unwind (5609); single-writer wakeup handshake (5610)
Verdict
untested (Low robustness/latency class; PoC skipped per contract - reproduction sketch in the finding)
No comments yet.