Summary

In ig4iic_attach, lwkt_serialize_enter(&sc->slz) is called at ig4_iic.c:648 before bus_setup_intr. If bus_setup_intr fails (line 651), the code prints a message and executes goto done (line 654) which returns error without calling lwkt_serialize_exit. The caller (ig4iic_pci_attach at ig4_pci.c:193-195 or ig4iic_acpi_attach at ig4_acpi.c:132-134) then invokes ig4iic_pci_detach → ig4iic_detach, which immediately calls lwkt_serialize_enter(&sc->slz) again (ig4_iic.c:678). The DragonFly lwkt serializer is explicitly non-recursive (serialize.h:41-42, lwkt_serialize.c:36-37), so this self-reentry deadlocks permanently: in DEBUG kernels ASSERT_NOT_SERIALIZED (lwkt_serialize.c:107) panics; in production kernels atomic_intr_cond_enter blocks the thread waiting for a lock it itself owns.

Root cause

ig4_iic.c:648 acquires sc->slz. ig4_iic.c:651-654 checks bus_setup_intr return and on failure does goto done (line 654). The done: label at line 669 is just return error; — there is no lwkt_serialize_exit on this path. Contrast with the bus_generic_attach error path at lines 660-664 which correctly calls lwkt_serialize_exit at line 658 before its goto done.

After attach returns error, ig4_pci.c:193-195 unconditionally calls ig4iic_pci_detach(dev); ig4iic_pci_detach calls ig4iic_detach (ig4_iic.c:674) which at line 678 does lwkt_serialize_enter(&sc->slz) on the already-held, non-recursive serializer.

serialize.h:41-42 states: "Unlike tokens this serialization is not safe from deadlocks nor is it recursive." lwkt_serialize_enter (lwkt_serialize.c:105-113) calls atomic_intr_cond_enter which, finding the interlock already held, invokes lwkt_serialize_sleep to block — but the holder is curthread, so it sleeps forever.

/* ig4_iic.c:648-655 — the bug */
lwkt_serialize_enter(&sc->slz);
error = bus_setup_intr(sc->dev, sc->intr_res, INTR_MPSAFE,
                       ig4iic_intr, sc, &sc->intr_handle, &sc->slz);
if (error) {
    device_printf(sc->dev, "Unable to setup irq: error %d\n", error);
    goto done;                    /* !!! serializer still held */
}

Threat model & preconditions

• Attacker position: Local root (kldload/kldunload privilege, or the condition triggers at boot if the I2C controller IRQ setup fails).
• Privileges gained or impact: The thread performing the driver attach/detach hangs permanently, and because it holds (or is waiting on) the serializer, any subsequent access to the I2C controller also blocks. On a system where this controller is used for critical devices (touchpad, sensors, ACPI power management via smbacpi child at ig4_iic.c:607), this can hang boot or render the system unresponsive.
• Required config or capabilities: Default kernel with ig4_iic configured. Root to force the trigger.
• Reachability: Requires bus_setup_intr to fail, which occurs under IRQ vector exhaustion, broken MSI/MSI-X allocation, or ACPI IRQ resource misconfiguration. The /dev/smb* node is 0600 root-only (smb.c:135-141), so the entire user-facing surface requires root; this finding is about kernel stability/hardening rather than privilege escalation.

Proof of concept

This is a reliability/hang bug, not a memory-corruption primitive, so there is no exploit chain to escalate. Reproduction: as root on a system with an Intel LPSS I2C controller (ig4iic), force bus_setup_intr to fail and observe the permanent hang.

The simplest deterministic trigger is a custom kernel module that wraps bus_setup_intr to return an error (fault injection), or resource exhaustion by loading many interrupt-consuming drivers until IRQ allocation fails for ig4iic.

Practical script:

1. kldload many MSI-consuming drivers to exhaust vectors.
2. kldload ig4iic — if bus_setup_intr fails, the kldload syscall hangs in D-state forever (uninterruptible sleep in lwkt_serialize_sleep).
3. Verify with ps axl | grep ig4iic showing a permanent D state thread, and procstat -kk <pid> showing lwkt_serialize_sleep → atomic_intr_cond_enter.

On a DEBUG kernel (INVARIANTS), the system panics immediately at the ASSERT_NOT_SERIALIZED KKASSERT in lwkt_serialize_enter instead.

Build & run

# Static verification fallback (no IRQ exhaustion needed):
# 1. Confirm lwkt_serialize_enter at ig4_iic.c:648 has no matching exit on the
#    bus_setup_intr error path (lines 651-654).
# 2. Confirm ig4iic_detach at ig4_iic.c:678 unconditionally re-enters the
#    serializer.
# 3. Confirm serialize.h:41-42 documents the serializer as non-recursive.

Expected output

Production kernel:

ig4iic0: <Intel LPSS I2C Controller> at pci0:15:0: class=...
ig4iic0: Unable to setup irq: error 6
[system hangs — kldload never returns; ps shows thread in D-state]

DEBUG / INVARIANTS kernel:

ig4iic0: <Intel LPSS I2C Controller> at pci0:15:0: class=...
ig4iic0: Unable to setup irq: error 6
panic: assert seralizer not held
cpuid = 0
Trace:
lwkt_serialize_enter() at lwkt_serialize.c:107
ig4iic_detach() at ig4_iic.c:678
ig4iic_pci_detach() at ig4_pci.c:...
device_detach() at subr_bus.c:...
...

No uid=0 or memory-write primitive is gained; impact is purely denial of service.

Impact

Local DoS via permanent thread self-deadlock when bus_setup_intr fails. High-privilege prerequisite (root to force IRQ exhaustion, or a hardware/firmware misconfiguration at boot) and high attack complexity (race against normal IRQ allocation) keep this at Low severity. The finding is filed as kernel stability / hardening.

Recommended fix

Add lwkt_serialize_exit(&sc->slz) before the goto done in the bus_setup_intr error path, matching the pattern already used by the bus_generic_attach error path at lines 658-664.

--- a/sys/bus/smbus/ichiic/ig4_iic.c
+++ b/sys/bus/smbus/ichiic/ig4_iic.c
@@ -648,8 +648,11 @@ ig4iic_attach(ig4iic_softc_t *sc)
    lwkt_serialize_enter(&sc->slz);
    error = bus_setup_intr(sc->dev, sc->intr_res, INTR_MPSAFE,
                   ig4iic_intr, sc, &sc->intr_handle, &sc->slz);
    if (error) {
        device_printf(sc->dev,
              "Unable to setup irq: error %d\n", error);
+       lwkt_serialize_exit(&sc->slz);
        goto done;
    }

References

• sys/bus/smbus/ichiic/ig4_iic.c:648-671 — ig4iic_attach (acquire with no matching exit on the error path)
• sys/bus/smbus/ichiic/ig4_iic.c:674-678 — ig4iic_detach unconditionally re-enters
• sys/sys/serialize.h:41-42 — serializer is documented as non-recursive
• sys/kern/lwkt_serialize.c:36-37, 105-113 — non-recursive implementation
• sys/bus/smbus/ichiic/ig4_pci.c:193-195 — caller's unconditional detach on attach error
• sys/bus/smbus/ichiic/ig4_acpi.c:132-134 — same for the ACPI attach variant

Timeline

• 2026-07-14 Discovered during automated audit.