DF-2683 — VERDICT

status: reproduced (impact: panic; hard-wedge variant = dos) attempts: 2 stock-kernel reproductions (1 silent machine wedge, 1 clean fatal trap), plus 4 fix-validation iterations (v1/v2 wedges, v3/v4 crashes -- see "Fix validation").

Root cause

fsetown() (sys/kern/kern_descrip.c:1296-1380) allocates the sigio zeroed, links it into the owner's list, and only initializes it afterwards:

1351/1357:  SLIST_INSERT_HEAD(&proc->p_sigiolst / &pgrp->pg_sigiolst,
                            sigio, sio_pgsigio);
1353/1359:  lwkt_reltoken(&proc->p_token / &pgrp->pg_token);
1362-1366:  sigio->sio_pgid / sio_ucred / sio_ruid / sio_myref set
            HERE, with no lock held.

So between the insert and the field initialization the sigio is on an owner list with sio_pgid == 0, sio_ucred == NULL, sio_ruid == 0, sio_myref == NULL. Concurrent teardown walkers consume list entries with no synchronization against this window:

exit1()    -> funsetownlst(&p->p_sigiolst)     (kern_exit.c:376)
pgdelete() -> funsetownlst(&pgrp->pg_sigiolst) (kern_proc.c:680)

funsetownlst:  while ((sigio = SLIST_FIRST(list)) != NULL)
                   funsetown(sigio->sio_myref);

Consuming a half-born sigio gives, depending on exactly where in the window the walker lands: * funsetown(NULL): sigio = *sigiop with sigiop == NULL -> NULL-page read fault; * sio_pgid still 0 -> funsetown takes the pgid>0/proc branch (or the union pointer is still NULL) and SLIST_REMOVE walks off the owner list -> fault at NULL+8 (movq 0x8(%rdx),%rax reading curelm->sio_pgsigio.sle_next with curelm == NULL); * myref set but *sigiop not yet published -> funsetown returns without unlinking -> funsetownlst spins forever (machine wedge under token pressure, no console output). Additionally the same walkers re-read the head without any lock, so a freed-and-recycled sigio chunk (same address, same sio_myref slot, different owner list) can be confused with the listed entry -- the wrong-list SLIST_REMOVE walk-off again (this survived several fix iterations; see below).

Reproduction (how/why)

Harness fsetown_race.c, unprivileged (uid 1001): parent forks short- lived children (same session -- passes the session check in fsetown) and hammers fcntl(sv0, F_SETOWN, child_pid) while each child exits. Each child's exit1() walks its p_sigiolst exactly when the parent's fsetown() is inside the insert->init window.

Run 1 (stock kernel): ssh session died mid-run, guest unresponsive, QEMU alive at ~3 vCPUs, zero serial output, no reboot -- total machine wedge (funsetownlst livelock variant).

Run 2 (stock kernel, fresh vm.sh reset with-src), serial console (panic.txt):

Fatal user address access from kernel mode from fsetown_race at ffffffff8062fe83
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address      = 0x8
fault code                 = supervisor read data, page not present
...
Stopped at funsetown+0x93: movq 0x8(%rdx),%rax
db>

Fatal trap INSIDE funsetown() at a NULL-derived address, attributed to the unprivileged fsetown_race process; kernel halted in DDB; ssh dead. Reproduced within the first 500 rounds both times (per-round hit probability is high because the parent re-arms the window hundreds of times per child lifetime).

Fix validation (attempted, still failing under storm)

Shipped fix.diff (v4): * fsetown(): full field initialization BEFORE the owner-list insert (kills the half-born consumption -- the demonstrated crash class); * funsetown(): load+clear under sigio_token; owner-list removals moved into funsetown_free() with no token nesting (v1/v2 that held sigio_token across the owner token livelocked against exit1()'s p_token -> sigio_token order); kfree() under a second exclusive sigio_token hold; * funsetownlst(): head-read/check/clear under sigio_token, with a 1-tick tsleep retry for publication-in-flight entries (the tight retry loop starved the publisher of sigio_token and wedged the machine; tsleep releases lwkt tokens so the publisher can run). Iterations v1..v4 each eliminated the window analyzed at the time, but the 20000-round storm still crashes the patched kernel with a double-teardown of a recycled sigio chunk (funsetown_free+0x63 / +0x95 walk-off; instrumented console output in panic.dbg.txt shows two funsetown_free() calls interleaving on two adjacent chunks with inconsistent list heads). The residual defect is in the restructured replacement machinery itself, not in the original demonstrated window; a correct fix needs a per-sigio reference count or a dedicated sigio list lock rather than composing the existing tokens. fix_status = fix_failed (honest, fully documented).

Bottom line

Unprivileged, syscall-only, twice-reproduced kernel crash (fatal trap inside funsetown()/funsetown_free() plus a no-output machine-wedge variant) from a publish-then-initialize defect in the core descriptor code. Fix direction validated stepwise; final fix requires upstream design iteration.