⬢ DragonFlyBSD Kernel Audit
DF-3903 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/sk/if_sk.c	2026-09-16 22:58:01.968006718 +0000
+++ b2/sys/dev/netif/sk/if_sk.c	2026-09-16 22:58:32.507613498 +0000
@@ -2038,7 +2038,16 @@
 
 	DPRINTFN(2, ("sk_tick\n"));
 
-	lwkt_serialize_enter(ifp->if_serializer);
+	if (!lwkt_serialize_try(ifp->if_serializer)) {
+		/*
+		 * Never park the softclock thread on the serializer:
+		 * sk_stop() tears this callout down with the synchronous
+		 * callout_stop() while holding the same serializer
+		 * (if_sk.c:2782) -> AB-BA deadlock.  Retry next tick.
+		 */
+		callout_reset(&sc_if->sk_tick_timer, 1, sk_tick, sc_if);
+		return;
+	}
 
 	if ((ifp->if_flags & IFF_UP) == 0) {
 		lwkt_serialize_exit(ifp->if_serializer);
@@ -2084,7 +2093,16 @@
 	struct ifnet *ifp = &sc_if->arpcom.ac_if;
 	struct mii_data *mii = device_get_softc(sc_if->sk_miibus);
 
-	lwkt_serialize_enter(ifp->if_serializer);
+	if (!lwkt_serialize_try(ifp->if_serializer)) {
+		/*
+		 * sk_stop() calls callout_stop(&sc_if->sk_tick_timer)
+		 * under this serializer (if_sk.c:2782) and callout_stop()
+		 * waits for an in-progress callback: blocking here
+		 * deadlocks the callout subsystem (AB-BA).
+		 */
+		callout_reset(&sc_if->sk_tick_timer, 1, sk_yukon_tick, sc_if);
+		return;
+	}
 	mii_tick(mii);
 	callout_reset(&sc_if->sk_tick_timer, hz, sk_yukon_tick, sc_if);
 	lwkt_serialize_exit(ifp->if_serializer);