wdog_disable() self-deadlocks/livelocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC)
| Field | Value |
|---|---|
| ID | DF-2967 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-667 |
| File | sys/kern/kern_wdog.c |
| Lines | 96, 171-177 (hook: kern_shutdown.c:860) |
| Area | kern |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
When the kernel panics while wdog_reset_all holds wdogmtx — i.e. a panic anywhere inside a driver callback, which DF-0236 forces to execute under the held spinlock — the WDOG_DISABLE_ON_PANIC hook calls wdog_disable(), which first does a synchronous callout_stop and then wdog_set_period(0) → spin_lock(&wdogmtx) on the lock the panicking thread itself holds. DFly spinlocks have no recursion guard, so the panic path spins forever with preemption disabled: the machine never reaches crash dump or reboot. Additionally the callout_stop wait loop livelocks if the callout is INPROG on a wedged CPU. Loss of the crash-dump/reboot-on-panic guarantee on hosts running a WDOG_DISABLE_ON_PANIC kernel (opt-in; documented only in LINT64) with an attached ichwd/amdsbwd watchdog. Availability-only; no memory-safety impact. Not guest-verified (stock GENERIC lacks the option and has no registered watchdog — verified via kern.conftxt + dmesg). Fix: panic-safe wdog_disable (skip lock-dependent work when panicstr; row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of kern_wdog.c (GLM 5.3). DF-0234..0238 re-verified still present, not re-reported.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2967 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 614 B | ↓ raw | |
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 316 B | view raw | |
| manifest.json | — | 507 B | view raw | |
| verdict.json | — | 1.8 KB | view raw |
DF-2967 PoC evidence pack
What
wdog_disable self-deadlocks the panic path when panic strikes inside wdog_reset_all (WDOG_DISABLE_ON_PANIC kernels).
Build
(none)
Run
(none)
Expected
config-verified absence of WDOG_DISABLE_ON_PANIC on stock kernel (cannot execute)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2967 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: denial_of_service | confidence: likely
Mechanism line-confirmed; cannot execute on the stock kernel because the compile-time gate is absent: WDOG_DISABLE_ON_PANIC is not in X86_64_GENERIC (only LINT-family configs; no opt_wdog header exists in the guest kernel objdir), so the kern_shutdown.c panic hook that calls wdog_disable is compiled out - verified against the kernel config source and the built obj tree. The rest of the setup IS present on the guest (ichwd/amdsbwd modules exist and a watchdog registered: wdog: In-kernel automatic watchdog reset enabled at boot), and the self-deadlock path (callout_stop blocking then spin_lock(&wdogmtx) recursion) is consistent with the code. Availability-only. Fix (panicstr-safe wdog_disable using callout_stop_async) compiled into the fix-all kernel.
Evidence pointers
config absence (X86_64_GENERIC has no WDOG_DISABLE_ON_PANIC); guest dmesg shows a registered watchdog; kern_wdog.c:96-177 ordering confirmed
Kernel references
PoC changes vs the filing sketch
cannot be exercised without a custom kernel build; reasoned verification per contract
Fix
recommendation: panic-safe wdog_disable (skip lock-dependent work when panicstr + callout_stop_async)
fix status: not_testable
compile-validated in fix-all kernel
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel
Confirmed kernel references
Detail
Evidence (decisive lines)
config absence (X86_64_GENERIC has no WDOG_DISABLE_ON_PANIC); guest dmesg shows a registered watchdog; kern_wdog.c:96-177 ordering confirmed
PoC changes
cannot be exercised without a custom kernel build; reasoned verification per contract
Verified recommended fix
panic-safe wdog_disable (skip lock-dependent work when panicstr + callout_stop_async)
Verdict
Mechanism line-confirmed; cannot execute on the stock kernel because the compile-time gate is absent: WDOG_DISABLE_ON_PANIC is not in X86_64_GENERIC (only LINT-family configs; no opt_wdog header exists in the guest kernel objdir), so the kern_shutdown.c panic hook that calls wdog_disable is compiled out - verified against the kernel config source and the built obj tree. The rest of the setup IS present on the guest (ichwd/amdsbwd modules exist and a watchdog registered: wdog: In-kernel automatic watchdog reset enabled at boot), and the self-deadlock path (callout_stop blocking then spin_lock(&wdogmtx) recursion) is consistent with the code. Availability-only. Fix (panicstr-safe wdog_disable using callout_stop_async) compiled into the fix-all kernel.
No comments yet.