DF-3601 — hdaa_sysctl_reconfig global-sysctllock self-deadlock (kernel freeze)

What

sysctl dev.hdaa.N.reconfig=1 — the documented, root-only HD Audio reconfiguration interface — permanently deadlocks the DragonFly kernel. No panic, no console output: the triggering thread sleeps forever holding the per-CPU global sysctllock SHARED (plus some other CPUs' locks EXCLUSIVE), and the system progressively wedges (sysctl, ps, login, and finally all new ssh sessions hang).

Root cause (source)

• userland_sysctl() holds SYSCTL_SLOCK() (the caller CPU's gd_sysctllock, SHARED) across the whole handler invocation: sys/kern/kern_sysctl.c:1572-1577.
• hdaa_sysctl_reconfig() (sys/dev/sound/pci/hda/hdaa.c:6474-6503) calls device_delete_children(dev) (hdaa.c:6492) and later bus_generic_attach(dev) (hdaa.c:6498) from inside that handler.
• pcm child detach (hdaa_pcm_detach → pcm_unregister, sys/dev/sound/pcm/sound.c:1233-1237) and re-attach run sysctl_ctx_free() / SYSCTL_ADD_*(), i.e. sysctl_unregister_oid()/sysctl_add_oid() → SYSCTL_XLOCK() (sys/kern/kern_sysctl.c:171-175, 446).
• DragonFly's _sysctl_xlock() takes every CPU's gd_sysctllock EXCLUSIVE (sys/kern/kern_sysctl.c:1642-1653). The handler's own thread therefore waits for its own SHARED hold → permanent self-deadlock. Other CPUs' locks already taken EXCLUSIVE poison sysctl system-wide.

Hardware-independent: reproduced on QEMU intel-hda + hda-duplex (benign codec); the deadlock is in the sysctl/device-tree interaction, not in codec data.

Reproduce (needs an HDA controller + snd_hda)

Guest booted with -device intel-hda -device hda-duplex:

# ./up.sh           # boots the DFly guest with the HDA device
vm.sh run_root 'kldload snd_hda; sleep 2; dmesg | tail -3'
vm.sh run_root "sysctl 'dev.hdaa.0.config=softpcmvol'"   # control: OK
vm.sh run_root 'sysctl dev.hdaa.0.reconfig=1'            # TRIGGER

Expected (vulnerable kernel): the sysctl write never returns; within seconds-to-minutes sysctl/ps/new ssh sessions hang system-wide; QEMU process stays alive; serial console silent (no panic).

Expected (patched kernel): write returns immediately (rc=0), dmesg shows pcm0: detached then pcm0: <...> at nid 3 and 5 on hdaa0, /dev/dsp0 re-created, system fully responsive (verified: 2 consecutive reconfigs).

Files

• run.log — controlled repro #2 (timing, lock-poisoning probe)
• boot.log.firstwedge, boot.log.repro2 — serial console of both wedges
• fix.diff — deferred-taskqueue fix (applies -p1, zero fuzz)
• fix_validation.log — patched module: trigger returns, pcm re-attach, health OK
• verdict.json, manifest.json, VERDICT.md

DF-3601 VERDICT — hdaa_sysctl_reconfig kernel self-deadlock

Status: reproduced (deterministic, 2/2 runs) — kernel deadlock / system freeze (dos). Fix: validated on guest (module rebuild + swap + re-trigger).

Setup

Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 2026, X86_64_GENERIC, QEMU -device intel-hda -device hda-duplex (QEMU's own benign codec, Generic (0x1af40022)), snd_hda loaded as KLD.

Reproduction timeline (run 2, controlled — see run.log)

1. kldload snd_hda → hdac0/hdacc0/hdaa0/pcm0 attach cleanly (boot.log.repro2 tail).
2. Negative control: sysctl dev.hdaa.0.config=softpcmvol (a tree-neutral hdaa sysctl write) returns instantly — proves ordinary hdaa sysctl writes are fine.
3. t=0 session A: sysctl dev.hdaa.0.reconfig=1 - sysctl(8) prints dev.hdaa.0.reconfig: 0 (the pre-write read-back) and then the write syscall NEVER returns; session A killed by an external timeout 30 — echo RC=$? / trailing date never execute.
4. t+7s session B: sysctl kern.osreldate still works (rc=0), ps works — consistent with the per-CPU lock analysis: the wedged thread holds its own CPU's gd_sysctllock SHARED and sleeps requesting EXCLUSIVE; CPUs whose lock it already acquired EXCLUSIVE (it iterates cpu 0..n-1) are poisoned immediately, others poison as soon as lockmgr queues the EXCLUSIVE request.
5. t+~120s: even new ssh connections hang (login path needs sysctl) — vm.sh status probe itself timed out. QEMU process alive, serial console silent (no panic — sleeping thread, not a crash).
6. Run 1 (accidental, same trigger): identical outcome (boot.log.firstwedge: console output simply stops after the attach messages; ssh dead; qemu alive). 2/2 deterministic.

Why (line-level)

• kern_sysctl.c:1572-1577 — SYSCTL_SLOCK(); error = sysctl_root(...); SYSCTL_SUNLOCK(); (SHARED per-CPU global sysctllock held across the handler).
• hdaa.c:6492 — handler calls device_delete_children(dev); hdaa.c:6498 bus_generic_attach(dev).
• sound.c:1233-1237 — pcm child detach frees its sysctl contexts (sysctl_ctx_free(&d->play_sysctl_ctx) / rec).
• kern_sysctl.c:171-175 — sysctl_unregister_oid() → SYSCTL_XLOCK(); kern_sysctl.c:1642-1653 — _sysctl_xlock() lockmgr's every CPU's gd_sysctllock LK_EXCLUSIVE.
• The same thread therefore blocks acquiring its own CPU's lock exclusively → sleeps forever; system-wide sysctl poisoning follows.
• Trigger privilege: root only (caps_priv_check_td(SYSCAP_NOSYSCTL_WR), kern_sysctl.c:1447). Not reachable by unprivileged users.

Fix

fix.diff: defer device_delete_children + unconfigure + configure + bus_generic_attach into hdaa_reconfig_task() on taskqueue_thread[mycpuid]; the sysctl handler only enqueues and returns. Drain the task in hdaa_detach before teardown. Zero-fuzz patch -p1.

Fix validation (fix_validation.log)

• cd /usr/src/sys/dev/sound/driver/hda && make → snd_hda.ko builds clean with -Werror.
• Swapped module, re-attached (hdaa0/pcm0 up).
• sysctl dev.hdaa.0.reconfig=1 → returns RC=0 in <1s; dmesg: pcm0: detached then pcm0: <Generic (0x1af40022) (Analog)> at nid 3 and 5 on hdaa0.
• Second reconfig: RC=0, /dev/dsp0 present, sysctl kern.osreldate responsive — HEALTH_OK.

Impact ceiling

Whole-kernel freeze from a single root sysctl write on any machine with an HDA codec (the standard "apply new pin config" workflow). Not a privilege escalation; no memory corruption. Bucket: base:dos.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.