DF-2532 — xdisk xa_start no-spans fail path KKASSERT panic

Finding

xa_start() (sys/dev/disk/xdisk/xdisk.c:976-984) calls xa_done(tag, 1) on the "no spans available, bio is allowed to fail" path without clearing tag->bio. xa_done() (xdisk.c:1009) opens with KKASSERT(tag->bio == NULL) which is compiled in by INVARIANTS (enabled in X86_64_GENERIC) → guaranteed kernel panic.

Trigger

Any BIO with B_FAILONDIS set issued against an xa device with empty spanq. This occurs during the disk framework's automatic label probe (disk_setdiskinfo → DISK_DISK_PROBE → mbrinit reads with B_FAILONDIS).

Build

# Harness module (deterministic trigger)
cc -DINVARIANTS -D_KERNEL ... -c df2532_harness.c   (via make / bsd.kmod.mk)
# Userland DMSG peer (supplementary)
cc -o df2532 df2532.c -Wall

Run

# Harness: load + trigger (as root)
kldload ./df2532_harness.ko   # xdisk.ko must NOT be loaded
sysctl -w debug.df2532_trigger=1
# Expected (unpatched): panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009

# Userland DMSG peer (as root, supplementary)
kldload xdisk
./df2532

Expected (bug present)

Kernel panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009

Expected (after fix.diff)

No panic; xa_done runs cleanly; xa_release handles the bio with EIO.

DF-2532 — xdisk xa_start no-spans fail path KKASSERT panic

Verdict: REPRODUCED (panic)

Summary

The xa_start() failure path for "no spans available, bio is allowed to fail" (xdisk.c:976–984, the else branch) calls xa_done(tag, 1) without clearing tag->bio. xa_done() (xdisk.c:1006–1017) opens with KKASSERT(tag->bio == NULL), which is compiled in by options INVARIANTS (enabled in the default X86_64_GENERIC kernel). The result is a guaranteed kernel panic whenever a BIO with B_FAILONDIS set is issued against an xa device that has no valid spans.

Mechanism (line-by-line trace)

1. Trigger: A BIO with B_FAILONDIS set is issued against an xa device whose spanq is empty (all spans deleted / target disconnected). This happens during the disk framework's automatic label probe (disk_setdiskinfo → DISK_DISK_PROBE → disk_probe → mbrinit → reads with B_FAILONDIS, subr_diskmbr.c:134).

2. xa_strategy() (xdisk.c:799) dispatches the BIO: - xa_setup_cmd() (xdisk.c:846) allocates a tag, sets tag->bio = bio (xdisk.c:856). - Calls xa_start(tag, NULL, 1) (xdisk.c:816).

3. xa_start() (xdisk.c:873): msg == NULL, enters the bio-dispatch block (xdisk.c:882). Checks for a valid span: c if (sc->opencnt == 0 || sc->open_tag == NULL) { TAILQ_FOREACH(trans, &sc->spanq, user_entry) { if ((trans->rxcmd & DMSGF_DELETE) == 0) break; } } if (trans == NULL) goto skip; // ← spanq empty No valid span → trans == NULL → goto skip.

4. skip: label (xdisk.c:956): msg is NULL. Checks B_FAILONDIS: c } else if (tag->bio && (tag->bio->bio_buf->b_flags & B_FAILONDIS) == 0) { // requeue path (B_FAILONDIS NOT set) — correctly clears tag->bio tag->bio = NULL; xa_done(tag, 1); } else { // FAIL path (B_FAILONDIS set) — THE BUG tag->status.head.error = DMSG_ERR_IO; xa_done(tag, 1); // ← tag->bio STILL SET (xdisk.c:982) }

5. xa_done() (xdisk.c:1006): c KKASSERT(tag->bio == NULL); // ← PANIC: tag->bio is non-NULL (xdisk.c:1009)

6. Panic: panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009

Exploit chain / escalation

Not a memory-corruption bug — this is a logic/state assertion bug (DoS). The KKASSERT panics the kernel before any corruption can occur. There is no write primitive, UAF, or type confusion. Impact is denial of service (kernel panic).

The only victim of xa_release() (which xa_done would call if the KKASSERT didn't fire) handles tag->bio != NULL correctly — it completes the bio with EIO and clears tag->bio. So on a non-INVARIANTS kernel the code path is actually correct; the bug is purely the incorrect assertion at xdisk.c:1009.

Reproduction

Deterministic harness (primary PoC)

A kernel module (df2532_harness.ko) that #includes the real xdisk.c (shipping code, static functions and all) and adds a sysctl trigger that constructs the exact impossible state and calls xa_start(tag, NULL, 0):

kldload ./df2532_harness.ko   # xdisk.ko must NOT be loaded
sysctl -w debug.df2532_trigger=1
# → panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009

Privilege: root (kldload + sysctl write). Realistic precondition: admin loads xdisk driver + configures a remote block target. When the target disconnects (span table empties), the next disk-label probe BIO triggers the panic. Any user-level action that triggers a disk reprobe (e.g. camcontrol, disklabel, or the async probe at device creation) can trip it; no special privilege beyond access to the xa device node.

DMSG userland PoC (supplementary)

df2532.c creates a DMSG peer via socketpair + XDISKIOCATTACH, sends LNK_SPAN CREATE then DELETE, and races span removal against the kernel's async disk label probe. The race is timing-dependent (the async probe is fast); the harness module provides the deterministic demonstration.

Fix

Remove the incorrect KKASSERT(tag->bio == NULL) at xdisk.c:1009. xa_release() (called from xa_done when tag->async) already handles tag->bio != NULL correctly — it completes the bio with EIO and clears tag->bio (xdisk.c:1031–1040). The assertion was wrong: xa_done CAN legitimately be called with tag->bio set, and the existing code handles it correctly once the assertion is removed.

--- a/sys/dev/disk/xdisk/xdisk.c
+++ b/sys/dev/disk/xdisk/xdisk.c
@@ -1006,7 +1006,7 @@
 static void
 xa_done(xa_tag_t *tag, int wasbio)
 {
-   KKASSERT(tag->bio == NULL);
+   /* tag->bio may be non-NULL here; xa_release handles it (DF-2532) */

    tag->state = NULL;
    tag->done = 1;

Fix validation

• Baseline (unpatched): harness trigger → panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009, guest crashes (DDB prompt).
• Patched (fix.diff applied): harness trigger → no panic; xa_done runs cleanly; "survived" printed; guest stays up.

PoC changes

Authored from scratch (no existing PoC): - df2532_harness.c — kernel module including real xdisk.c with sysctl trigger - df2532.c — userland DMSG peer (supplementary, race-based) - Makefile — kld module build for the harness - fix.diff — one-line fix removing the incorrect KKASSERT