DF-2212 — ttm_exit() uninterruptible deadlock (dead wait_event)

sys/dev/drm/ttm/ttm_module.c:98 — ttm_exit() ends with wait_event(exit_q, atomic_read(&device_released) == 1) but the only compiled setter of device_released=1 is #if 0'd out; the init success path zeroes it and success is guaranteed (dev_set_name and drm_class_device_register are no-ops returning 0 on DF). The thread that runs ttm_exit at module unload — the kldunload(2) thread via linker_file_sysuninit (kern_linker.c:535) — sleeps uninterruptibly forever: D-state, SIGKILL ignored, module half-unloaded.

Verdict: reproduced (baseline: 80 s watchdog, 16/16 samples blocked, sigkill pending+ignored, D0/wchan "lwe"; fixed: exit returns in 0 ms, 500 clean init/exit cycles). Impact: unkillable-thread DoS wedge, root-triggered (kldunload); no unprivileged reach, no memory corruption. Severity Low.

Reproduce (on the DragonFly audit guest)

# 1. push the pack to the guest (or use the copies under /root/poc/DF-2212)
#    df_ttm2212.c build.sh run.sh run_fixed.sh ttm_module_fixed.c fix.diff
# 2. build + install the baseline harness kernel (pristine ttm_module.c,
#    sha256-gated 56d64f99e2ee74fee71bdb775463f51cbc6a1d3f9096f2da25af60b55ab26b8e)
sh build.sh baseline            # make -j6 nativekernel KERNCONF=DFV2212
cp /usr/obj/usr/src/sys/DFV2212/kernel.stripped /boot/kernel/kernel
cp /usr/obj/usr/src/sys/DFV2212/kernel.debug   /boot/kernel/kernel.debug
shutdown -r now
# 3. run the baseline test (~100 s)
sh run.sh                       # -> run.log: D0 state, wchan lwe,
                                #    kill -9 ignored, watchdog verdict

# 4. apply the fix, rebuild, rerun
cp ttm_module_fixed.c /usr/src/sys/dev/drm/ttm/ttm_module.c   # == fix.diff applied
sh build.sh fixed
cp /usr/obj/usr/src/sys/DFV2212/kernel.stripped /boot/kernel/kernel
cp /usr/obj/usr/src/sys/DFV2212/kernel.debug   /boot/kernel/kernel.debug
shutdown -r now
sh run_fixed.sh                 # -> run_fixed.log: returns in 0 ms,
                                #    500 cycles, nothing stuck

Success criterion (baseline): ps shows the trigger process in state D0 with wchan lwe at t=3 s, 6 s, 33 s and 93 s after kill -9; kernel log shows 16/16 watchdog samples with TDF_TSLEEPQ=YES wmesg="lwe" device_released=0 sigkill_pending=1 and the final WATCHDOG VERDICT line; the trigger sysctl never returns. Success criterion (fixed): ttm_exit() RETURNED after 0 ms, 500 init/exit cycles complete, no stuck processes.

Rig

df_ttm2212.c is compiled into the kernel (config DFV2212 = X86_64_GENERIC + device dfverify) and #includes the REAL <dev/drm/ttm/ttm_module.c> (sha256-gated by build.sh) plus verbatim lkpi linux_wait.c/linux_sched.c. The two drm_sysfs externs are provided with exactly the shipped semantics (drm_sysfs.c:60-75). module_init(ttm_init) runs at boot (control); hw.df_ttm2212.trigger calls the real ttm_exit() in the calling thread (kldunload-thread simulation); a 5 s callout watchdog samples the blocked thread.

Files

• df_ttm2212.c — harness (verbatim interposition)
• build.sh — sha256-gated baseline/fixed kernel build
• run.sh / run_fixed.log-companion run_fixed.sh — test drivers
• ttm_module_fixed.c — pristine+fix.diff (sha256 4faabe2f…)
• fix.diff — the verified one-hunk fix
• build.log / fix_build.log — FULL untrimmed kernel builds
• run.log — FULL baseline runtime output (decisive)
• run_fixed.log — FULL fixed runtime output
• trigger.out — baseline trigger process stdout (no exit line)
• dmesg.txt — full dmesg spanning baseline and fixed eras
• env.txt — guest environment
• VERDICT.md — full narrative
• manifest.json / verdict.json — machine-readable

DF-2212 — VERDICT

File: sys/dev/drm/ttm/ttm_module.c (lines 37-60, 77, 84-85, 89-99) Claim: ttm_exit() deadlocks forever in an uninterruptible wait_event on a condition that can never become true; at kldunload/SYSUNINIT the calling thread waits unkillably. Severity as filed: Low (root-triggered DoS wedge). Status: REPRODUCED.

Bottom line

Reproduced on the QEMU guest with the real, verbatim production code compiled into a harness kernel (rig class: verbatim interposition, kernel-compiled because runtime kldload of drm GPFs on this guest). The thread that runs the real ttm_exit() — the same function linker_file_sysuninit() (sys/kern/kern_linker.c:535) runs in the kldunload(2) syscall thread of drm.ko — blocks in uninterruptible sleep forever: D-state, kill -9 delivered and ignored (pending in p_siglist for 80+ s of watchdog sampling), device_released stuck at 0 with no compiled code path able to set it to 1. The one-line-class fix (delete the dead wait) makes exit return in 0 ms with 500 clean init/exit cycles and no other behavior change. Impact is a root-triggered unkillable-thread/module-unload wedge (DoS); there is no memory-corruption primitive and no privilege boundary crossed — the privesc directive is closed: not applicable.

Why the condition can never become true (source certainty)

• static atomic_t device_released; — ttm_module.c:38. Grep of the whole sys/ tree: the ONLY writes of the value 1 are ttm_module.c:50 (ttm_drm_class_device_release) and ttm_module.c:84 (init error path).
• ttm_module.c:40-53: the release function and its .release hookup (ttm_module.c:56-59) are inside #if 0 — never compiled.
• The success path zeroes it: ttm_module.c:77 (atomic_set(&device_released, 0)), and success is guaranteed on DF: dev_set_name is a static inline returning 0 (sys/dev/drm/include/linux/device.h:106-110) and drm_class_device_register is a shipped no-op returning 0 (sys/dev/drm/drm_sysfs.c:60-63). drm_class_device_unregister is an empty body (drm_sysfs.c:73-75) — the DF port's device model never invokes any release.
• wait_event maps to __wait_event_common(wq, cond, 0, 0, false) (sys/dev/drm/include/linux/wait.h:171-172): flags 0 → no PCATCH → TASK_UNINTERRUPTIBLE (wait.h:121) and tsleep(current, PINTERLOCKED, "lwe", hz) in a loop that only exits when the condition holds (wait.h:124-151). Signals do not interrupt it.
• module_exit(ttm_exit) is SYSUNINIT(ttm_exit, SI_SUB_DRIVERS, SI_ORDER_SECOND, ...) (sys/dev/drm/include/linux/module.h:60-61), run by linker_file_sysuninit() — sorted descending, executed in the caller's thread (kern_linker.c:188-231, invoked from linker_file_unload at :535 after dropping llf_lock at :533-534).

Honest refinement of the filed claim: DF shutdown does not run module SYSUNINITs at all (kern_shutdown.c contains no linker/sysuninit references; only kldunload paths invoke linker_file_sysuninit). The "or shutdown" arm of the claim is therefore not the live path on DF; the real-world trigger is kldunload drm (or a dependency/forced unload cascade), which requires root. Consequence on a real drm-bearing system: the unloading thread is unkillable (D-state forever), the drm module is left half-torn (LINKER_FILE_LINKED cleared, sysuninit incomplete — kern_linker.c:531-535), and the operation never completes. No unprivileged reach; Low severity is correct.

Rig (verbatim interposition, kernel-compiled)

• Harness df_ttm2212.c #include <dev/drm/ttm/ttm_module.c> — the REAL tree file, sha256-gated (56d64f99e2ee74fee71bdb775463f51cbc6a1d3f9096f2da25af60b55ab26b8e, byte-identical guest/audited trees), plus verbatim linux_wait.c/linux_sched.c (lkpi wait/sched support; the lkpi current macro lazily allocates the task_struct via linux_task_alloc, linux_sched.c:59). The two externs ttm calls are provided with EXACTLY the shipped semantics of drm_sysfs.c:60-75 (return 0 / empty) plus observation counters — the only additions.
• Kernel config DFV2212 = X86_64_GENERIC + device dfverify (INVARIANTS + DDB preserved). module_init(ttm_init) fires at boot via SYSINIT — the free control.
• hw.df_ttm2212.trigger=1 calls the REAL ttm_exit() in the sysctl thread — same thread-context as the kldunload path.
• A 5-second callout watchdog on another CPU samples the blocked thread (TDF_TSLEEPQ, td_wmesg, td_wchan, device_released, SIGKILL-pending bit in p_siglist).
• Disclosed jig: a SYSUNINIT(..., SI_ORDER_THIRD) would release the wait before ttm_exit's SI_ORDER_SECOND in any module-style uninit walk — inert here because DF never walks built-in sysuninit_set; it exists so the rig cannot wedge a shutdown path even by accident.

Baseline results (pristine tree file) — run.log, dmesg.txt

df_ttm2212: BOOT CHECK: ... register_calls=1 device_released=0
  (register>0 + value 0 => SUCCESS path => a later ttm_exit() can
  never pass its wait)
df_ttm2212: TRIGGER pid=878 (sysctl): calling the REAL ttm_exit() ...
Trace beginning at frame ...        <- print_backtrace at wait entry
userland_sysctl() ... sys___sysctl() ... syscall2() ...
ps:  878 D0     lwe      sysctl     <- t=3s, 6s, 33s, 93s: D-STATE,
                                         wchan "lwe" (= wait.h:135 tsleep wmesg)
df_ttm2212: WATCHDOG sample 1..16/16 t+5s..t+80s:
    TDF_TSLEEPQ=YES wmesg="lwe" wchan=0x... device_released=0
    sigkill_pending=1 kill9_marker=set
df_ttm2212: WATCHDOG VERDICT after 16 samples (~80s): ttm_exit()
  thread STILL blocked; device_released=0 and no compiled code path
  in sys/ can ever set it to 1 -> wait_event can never return; sleep
  is uninterruptible (no PCATCH)

• kill -9 878 was sent (kernel kill9 marker set at tick 5963); the kernel-side samples show sigkill_pending=1 — the signal is posted and ignored: the process survives SIGKILL for the full 93 s observation (and beyond; it only dies with the box).
• trigger.out contains no exit line — the sysctl(8) process never returned from the kernel.
• exit_ms=-1, exit_done=0 for the whole run.
• Cross-kernel corroboration: the warm-reboot msgbuf carried the baseline watchdog lines into the fixed kernel's dmesg (dmesg.txt holds both eras back-to-back).

Fixed results (tree file = pristine + fix.diff, sha256

4faabe2f6a7f28231bcee79db239110a4b909985a67a4f12d93ab62f715187b9) — run_fixed.log, dmesg.txt

df_ttm2212: ttm_exit() RETURNED after 0 ms (device_released=0) -
  fixed kernel behaviour
df_ttm2212: CYCLE: 500 x (ttm_init(); ttm_exit()) completed, every
  call returned
--- trigger: the sysctl command itself must COMPLETE now ---
        0.07 real ... trigger rc=0
--- stuck sysctl procs: (none)

device_released is still 0 after the fixed exit — proving the wait was removed (not that the condition somehow became true). Identical kernel otherwise; boot check unchanged; guest healthy.

Fix

fix.diff (git-apply-able, verified to apply to the pristine tree and to reproduce the tested fixed file byte-for-byte): delete the dead wait_event and its "Not sure this is 100% needed" comment from ttm_exit(). This is the maintainer-minimal shape the author himself anticipated. exit_q/device_released and the init error-path wake are deliberately left untouched so the patch stays one-hunk reviewable; a follow-up cleanup could delete them together with the #if 0 block.

Checklist / negatives

• No unprivileged trigger exists (sysctls are root-only; the real path is kldunload(2) = privileged). Not memcorrupt; privesc N/A.
• "Wedges module linker": refined — llf_lock is RELEASED around the sysuninit call (kern_linker.c:533-535), so the global linker lock is not held; the wedge is the unkillable unloader thread plus a half-torn module (LINKER_FILE_LINKED cleared before the blocking sysuninit, module never leaves linker_files cleanly).
• Shutdown arm of the filed claim: killed by source reading (no sysuninit walk at shutdown on DF).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.