NTP PLL discipline state is mutated by hardclock/pps interrupt paths with no lock excluded from sys_ntp_adjtime's ntp_lock — interleaved PLL transitions

Summary

hardclock() on cpu0 calls ntp_update_second() AFTER releasing ntp_spin, and pps_event() calls hardpps() from device-interrupt context with no lock at all. Meanwhile sys_ntp_adjtime() serializes its PLL updates with lockmgr ntp_lock + crit_enter — a lock neither interrupt path takes, and a crit section that does not exclude interrupts on other CPUs. Consequently time_state/time_status multi-field transitions, time_offset/time_adj/time_freq updates, hardupdate()'s estimates and hardpps()'s pps_tf[]/pps_freq can interleave arbitrarily. Bounded to clock correctness: on supported platforms (pc64/vkernel64 only) every PLL variable load/store is atomic, all steady-state magnitudes stay clamped, per-tick basetime adjustments are normalized; worst realistic outcome is a transient clock error of order ~0.5s during concurrent root-driven ntp_adjtime/hardpps activity. Every racing writer is already privileged or requires PPS hardware (the unprivileged-kernel-consumer route is exactly known DF-0022). Historical 64-bit tearing was only possible on the removed i386 platform.

Recommended fix

Extend ntp_spin over the ntp_update_second() call at :749-751, and take ntp_spin in hardpps() (or convert sys_ntp_adjtime to ntp_spin) so all PLL-state writers share one lock:

--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -746,8 +746,10 @@ hardclock(systimer_t info, int in_ipi, struct intrframe *frame)
         * Apply leap second (ntp_adjtime() API), calculate a new
         * nsec_adj field.  ntp_update_second() returns nsec_adj
         * as a per-second value but we need it as a per-tick value.
         */
+       spin_lock(&ntp_spin);
        leap = ntp_update_second(time_second, &nsec_adj);
        nsec_adj /= hz;
+       spin_unlock(&ntp_spin);
        nbt->tv_sec += leap;

Timeline

• 2026-08-30 Discovered during pass-2 audit of kern_clock.c (GLM 5.3).