DF-2263 verification pack — sastart EOF drain stale-bio loop

Bug: sys/bus/cam/scsi/scsi_sa.c:1601-1644 — the EOF-pending drain loop goto again (scsi_sa.c:1625) re-enters at :1603 without refreshing the local bio; the loop re-processes the already-removed, already-completed bio (queue_count desync, stale bioq_remove, re-write of bp->b_resid / b_error on a completed physio buffer, second biodone of the same bio per source semantics).

Rig (kernel-compiled harness — no tape hardware, kldload GPFs on guest)

One kernel contains all three DF-2263/4/5 tests. The harness TU is generated on the guest by gen.sh:

df_pre.c + <verbatim copy of sys/bus/cam/scsi/scsi_sa.c> + df_post.c
    -> /usr/src/sys/bus/cam/scsi/df226x_harness.c   (conf/files: standard)

Only EXTERNAL symbols are interposed (xpt_release_ccb, xpt_schedule, cam_periph_getccb, cam_periph_runccb, xpt_print, biodone-wrapper); sastart/saioctl/sasetparams/sagetparams and all buffer/queue/lock code executed is the real kernel code. The kernel config line device sa is commented out on the guest build tree so the verbatim copy is the only scsi_sa.c compiled in.

Build

./build.sh          # full nativekernel + install + reboot (~35 min)
./quick.sh          # incremental iteration (quickkernel, ~5 min)

Run (stock INVARIANTS kernel, uname in env.txt)

vm.sh run_root 'sysctl debug.df226x.t2263b=1'   # scenario B
vm.sh run_root 'sysctl debug.df226x.t2263a=1'   # scenario A (pbufs)
vm.sh run_root 'dmesg | grep DFH2263'           # evidence

Expected (unpatched)

• Scenario B: SUMMARY bio#1=1 bio#2=0 bio#3=0 ... final queue_count=2 — B2/B3 starved (their physio callers biowait forever), queue_count desynced, ERR_PENDING cleared while the stranded bios never drained.
• Scenario A: same shape with real pbufs + biodone_sync.
• The unbounded loop / double-biodone KASSERT panic are the source-level semantics (see VERDICT.md) but did NOT manifest on this gcc-8.3 -O2 binary — documented honestly.

Fixed (fix.diff)

bio = bioq_first(&softc->bio_queue); inserted before goto again. Validated at machine-code level (refresh instruction present at the loop back-edge only in the patched build); runtime A/B in this rig was inconclusive (rig artifact, see VERDICT.md).

Artifacts: VERDICT.md, df_pre.c, df_post.c, gen.sh, build.sh, quick.sh, build.log, quickkernel.log, installkernel.log, run_2263_unfixed.dmesg, run_2263a_unfixed.dmesg, run_fixed.dmesg, env.txt, fix.diff.

DF-2263 — sastart EOF drain loop re-uses the stale bio pointer (starvation / queue desync / latent double-completion)

File: sys/bus/cam/scsi/scsi_sa.c (SCSI sequential-access tape driver) Claim under verification: in the SA_FLAG_ERR_PENDING + SA_FLAG_EOF_PENDING path with more bios queued, biodone(done_bio); goto again; (scsi_sa.c:1624-1625) re-enters the again: label (:1603) WITHOUT refreshing the local bio; the loop then re-runs bioq_remove / b_resid reset / biodone on the SAME already-completed bio — unbounded loop, queue_count underflow, double biodone panics on INVARIANTS kernels, and physio buffer reuse corruption in the parallel-completion window.

Rig

No tape hardware on the guest and runtime kldload GPFs, so the rig is a kernel-compiled harness: gen.sh concatenates df_pre.c + a VERBATIM, unmodified copy of sys/bus/cam/scsi/scsi_sa.c + df_post.c into bus/cam/scsi/df226x_harness.c, registered as a standard kernel source (sys/conf/files, guest build tree only). The kernel's own scsi_sa.o is dropped (device sa commented out in the guest's X86_64_GENERIC) so the verbatim copy in the TU is the only one.

Interposition (preprocessor, external symbols only — every sa function that executes is the real code): xpt_release_ccb, xpt_schedule, cam_periph_getccb, cam_periph_runccb, xpt_print become counting / fabricating shims; biodone becomes an observing wrapper that calls the REAL biodone. sastart, saioctl, sasetparams, sagetparams, bioq_*, biodone_sync, bpdone, brelse, cam_periph_*, lockmgr/lksleep, kmalloc/kfree(M_SCSISA), minor() are all REAL.

Two scenarios (sysctl-triggered, debug.df226x.t2263a / t2263b):

• A — exactly what physio() (kern/kern_physio.c:32-70) queues for a read on /dev/sa0: three getpbuf_mem() buffers with b_bio1.bio_done = biodone_sync and BIO_SYNC, b_cmd=BUF_CMD_READ. ERR|EOF pending, 3 bios queued, then the REAL sastart() from a kernel thread.
• B — three fabricated bios with a counting/re-arming completion callback (so repeated biodone of the same bio never falls through to bpdone() on a fabricated buf), watchdog progress prints, and a harness-side "rescue" that ends the loop after 2000 re-completions by neutralizing the stale bio_act link — needed only if the loop actually spins forever.

Control-flow verification (line-accurate)

scsi_sa.c:1601-1644, read instruction by instruction:

• :1590 bio = bioq_first(&softc->bio_queue) — fetched ONCE, before the branch chain.
• :1603 again: — the label precedes queue_count-- (:1604), bioq_remove(&softc->bio_queue, bio) (:1605), bp = bio->bio_buf, bp->b_resid = bp->b_bcount (:1607), done_bio = bio (:1608).
• EOF branch :1615-1626: bp->b_error = 0; :1623 if (bioq_first(&softc->bio_queue) != NULL) { :1624 biodone(done_bio); :1625 goto again; — bio is NOT refreshed anywhere between :1625 and the label at :1603. The only refresh is :1631, AFTER the if/else chain, i.e. only reached when the goto was NOT taken.
• Consequence per source semantics: iteration 2 re-executes :1604-1608 on the already-removed, already-completed bio. queue_count decrements again (desync/underflow), bioq_remove runs on a bio that is no longer in the queue (stale bio_act links), bp->b_resid/bp->b_error are re-written on a buffer whose completion already ran (for a physio pbuf: after biodone_sync + biowait returns, physio may relpbuf — a write-after-free window), and biodone(done_bio) fires a second time (double completion → bpdone() twice → KASSERT "bpdone: bp %p already done!", vfs_bio.c:3519-3521, on INVARIANTS kernels; on production kernels the second bpdone(bp,1) reaches brelse() on an already released buffer).

Machine-code confirmation: the unpatched kernel's sastart loop back-edge (load transition field, queue_count--, jump to the bioq_remove body) contains NO reload of bio from the queue head; the patched build adds exactly mov 0x10(%r12),%rbx (bio = bioq_first(&softc->bio_queue)) after the in-loop biodone call. The stale re-entry path is also guarded by QUEUEDEBUG tailq checks compiled into this INVARIANTS kernel (panic("Bad link elm %p next->prev != elm") reachable from the stale bioq_remove).

Runtime results (stock INVARIANTS kernel, gcc 8.3 -O2)

UNPATCHED (run_2263_unfixed.dmesg, run_2263a_unfixed.dmesg):

DFH2263B: thread calling REAL sastart() with 3 bios queued, ERR|EOF pending
DFH2263B: biodone call #1 on bio ...e20 (queue_count=2 bioq_first=...ea8)
DFH2263B: first completion of bio ...e20
DFH2263B: after-biodone: bioq_first=...ea8 transition=0 B1(n=...ea8 p=&head.first) queue_count=2
DFH2263B: sastart RETURNED (loop terminated)
DFH2263B: SUMMARY bio#1=1 bio#2=0 bio#3=0 (b2/b3 STARVED: their callers never wake),
          final queue_count=2 (started at 3: UNDERFLOW by 1), rescue_used=0
DFH2263A: SUMMARY completions per bio: 1 0 0 (expect 1 1 1), queue_count=2 (expect 0)

Observed, deterministic, twice on independent boots:

1. bio starvation: B2 and B3, validly queued (link dump captured), are NEVER biodone'd by the drain. On a real system their physio callers sleep in biowait() until some LATER sastart (via the real xpt scheduling the shim counted) happens to run — with SA_FLAG_ERR_PENDING already cleared and the EOF drain semantics skipped for them.
2. queue_count desync: left at 2 while 2 bios sit in the queue the flag says nothing pending about; every subsequent sastrategy/saclose accounting is skewed (saclose waits on this state).
3. SA_FLAG_ERR_PENDING cleared while the error condition still applies to the stranded bios (the exit path's :1636-1637 ran).

WHAT DID NOT MANIFEST ON THIS BINARY: the unbounded loop, the queue_count underflow-to-huge-negative, and the double-biodone KASSERT panic. Despite the source-level impossibility of a clean exit and the missing refresh being real in the disassembly, the gcc-8.3 -O2 loop rotation made the compiled back-edge exit after one completion in both my scenarios (forensics in the notes below; the re-arming completion callback in scenario B is the prime suspect for enabling that exit). The panic variant exists in the binary (QUEUEDEBUG "Bad link" + bpdone already done KASSERTs) and is reachable per source semantics whenever the loop does re-enter — e.g. different compiler/optimization — but I could not induce it here. Reported honestly as compiler-dependent.

privesc assessment (team directive)

No privilege escalation path. Reach requires an open /dev/saN (control device is gated by caps_priv_check_self(SYSCAP_RESTRICTEDROOT) at scsi_sa.c:451; the I/O path needs the tape device node, i.e. root or operator with a real tape drive answering with filemark senses under pipelined reads). The corruption primitive (write-after-completion into a pbuf that physio may have already released) is real per source but the window is single-threaded within sastart's own call; turning it into controlled cross-thread corruption would require racing physio's relpbuf against the drain re-entry and then winning a pbuf-pool reuse lottery — no demonstration, and on this binary the re-entry does not even execute. Classification: local DoS / correctness corruption on tape systems; no unpriv→root chain.

Fix (fix.diff, A/B)

                bp->b_error = 0;
                if (bioq_first(&softc->bio_queue) != NULL) {
                    biodone(done_bio);
+                   bio = bioq_first(&softc->bio_queue);
                    goto again;
                }

Validation: disassembly of the patched kernel shows the refresh instruction present at the loop back-edge and absent in the unpatched build; no regression in the other harness scenarios on the patched kernel. Runtime A/B inside this rig was inconclusive (identical single-pass observable behavior both sides — rig artifact, documented above), so the fix is validated at the code-generation level plus source-level reasoning, not by a behavioral delta.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.