DragonFlyBSD Kernel Audit
DF-2918 / run.2.log
← back to finding ↓ download raw
Fix validation runs (guest kernels built in-guest via
`cd /usr/src && make -j4 nativekernel KERNCONF=X86_64_GENERIC && make installkernel`)

BASELINE (stock INVARIANTS kernel #0, Jul  2 2026)
--------------------------------------------------
Race workload (3 root mounters `mount("fuse",dir,0,NULL)` @ ~7-13k/s +
kldloop kldload/kldunload("/boot/kernel/fuse.ko", gap 10ms) + 2 unpriv
sysctl readers):
  Run 2  (10:00, 6 mounters, no gap):   wedge at ~60-90 s
  Run 4  (10:09, 16 mounters, no gap):  wedge at ~4 min
  Run 5  (10:18, 3 mounters, gap 10ms): wedge at ~15 s
  Run 6  (10:26, gap 50ms):             wedge at ~10 s
Wedge signature: all mounters persistent D-state, wchan
ncplk/syncexit/vnode, kldloop wedged in linker, fuse.ko pinned loaded,
mount(2)+kldload+kldunload dead, SIGKILL ineffective, shutdown hangs,
debug.panic hangs in "syncing disks...". Only hard reset recovers.
Control (mounters only, no unload churn, 90 s): clean, 600k iters each.

FIX v1 (kernel #1, Sep 3 10:40 - registry lock + acquire/release)
------------------------------------------------------------------
Race workload (3 mounters, gap 10ms): mounters survived ~1.6-2M
iterations (~10x baseline wedge point) but STILL wedged at ~100-150 s
(same ncplk/syncexit/vnode signature). => the vfsconf lifetime TOCTOU is
closed, but a second unsynchronized edge remains: sys_mount's in-syscall
autoload (vfs_syscalls.c:324) runs while the mountpoint vnode is
exclusively locked and can wait on the linker lock held by kldunload's
module teardown (AB-BA), plus vn_syncer_thr_stop() waits unconditionally
for a syncer thread whose kthread_create() result is ignored
(sys/kern/vfs_sync.c:318-322,349).

FIX v2 (kernel #2, Sep 3 10:56 - adds in-flight-mount veto)
------------------------------------------------------------------
vfsconf_mount_begin()/vfsconf_mount_end() bracket sys_mount();
vfs_unregister() returns EBUSY while any mount syscall is in flight.
Race workload (IDENTICAL parameters to the runs above, 600 s budget):
  === survived 600 seconds ===
  -- mloop.0: pid=816 iter=6600000 ok=0 fail=6600001
  -- mloop.1: pid=817 iter=4800000 ok=0 fail=4800001
  -- mloop.2: pid=818 iter=5000000 ok=0 fail=5000001
  -- sloop.0: pid=840 iter=161000000 ok=161000001 fail=0
  -- kldloop: no error storm (no "Exec format" lines), cycling with
     EBUSY vetoes during busy periods
  0 persistent D-state processes at completion; guest healthy
  (load ~2.6); no panic; no wedge; clean shutdown not attempted but all
  actors exited at SIGTERM (race.log epilogue written).

uname -a (fix kernel): DragonFly dfbsd 6.5-DEVELOPMENT #2: Thu Sep  3
10:56:41 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
build: RC=0 (build3.log), install: RC=0 (install3.log)