DF-3760 — alc_stop()/alc_tick() callout AB-BA deadlock (DF-3715 family)

Severity: Medium (privileged local permanent kernel deadlock / DoS) — DragonFly sys/dev/netif/alc/if_alc.c, pass 2 (GLM 5.3).

What

alc_tick is an MP-safe, self-re-arming callout whose handler takes the driver serializer blocking:

static void
alc_tick(void *arg)
{
    ...
    lwkt_serialize_enter(ifp->if_serializer);   /* :3414 BLOCKING */
    mii_tick(mii); alc_stats_update(sc); alc_txeof(sc); alc_watchdog(sc);
    callout_reset(&sc->alc_tick_ch, hz, alc_tick, sc);  /* :3428 */
    lwkt_serialize_exit(ifp->if_serializer);
}

alc_stop tears it down while holding that same serializer:

static void
alc_stop(struct alc_softc *sc)
{
    ASSERT_SERIALIZED(ifp->if_serializer);      /* :3965 */
    ...
    callout_stop(&sc->alc_tick_ch);         /* :3973 */

On this kernel callout_stop() is the synchronous variant (sys/kern/kern_timeout.c:1091 → _callout_cancel_or_stop(..., sync=1)); when the callback is INPROG it ssleeps on "costp" (sys/kern/kern_timeout.c:923) until the callback completes.

⇒ If alc_tick fired and is parked inside lwkt_serialize_enter (if_alc.c:3414) on the serializer held by the alc_stop() caller, the stopper sleeps in callout_stop() waiting for the callback, and the callback sleeps waiting for the serializer: permanent AB-BA deadlock. Both threads wedge forever, the interface serializer is never released (every later driver path on that interface blocks: ioctls, interrupts, tick), and the affected CPU's softclock thread stops delivering all callouts.

Callers of alc_stop with the serializer held: alc_init (if_alc.c:3580 — every reinit: ifconfig up/down alc_ioctl :2824/:2826, watchdog :2774/:2779, DMA-error interrupt alc_intr :3087/:3103), alc_detach (:1616), alc_suspend (:2437).

Trigger: ifconfig alc0 down (or MTU change / detach / suspend-resume) while the 1 Hz tick callback is dequeued-and-parked — a ~1% per-stop race window, repeatable by a privileged local user.

Same defect as DF-3715 (if_em.c), independent instance in if_alc.c. DF-3715's guest replica also proved the negative: on this kern_timeout.c callout_stop's STOP unloads a racing re-arm, so the defect here is the sync-wait deadlock, not a post-stop re-arm UAF.

Reproduce (mechanism, on this guest — deterministic)

scp alc_callout_replica.c + Makefile to guest:/root/kmod
cd /root/kmod && make                       # build.log
kldload /root/kmod/alc_callout_replica.ko
sysctl kern.alcreplica.arm=1
sysctl kern.alcreplica.stop_try=1           # FIX-shape control: returns, pending=0
(sysctl kern.alcreplica.stop_blk=1 &)       # shipped-shape: NEVER returns
dmesg | grep 'alcreplica\[blk\]'            # "IF THIS IS THE LAST alcreplica LINE,"
ps -o pid,stat,wchan,command -ax | grep stop_blk
#  -> <pid> D5  costp  sysctl kern.alcreplica.stop_blk=1   == kern_timeout.c:923

The replica reproduces if_alc.c's exact protocol (blocking lwkt_serialize_enter + callout_reset(hz) self re-arm vs callout_stop under the serializer). Expected: the last dmesg line is the marker, the sysctl thread sits D-state, wchan costp forever, and the guest must be reset. The alc-specific instance itself needs AR81xx hardware, which the audit guest lacks (env.txt).

Fix

fix.diff — mirror the DF-3715 fix: alc_tick uses lwkt_serialize_try(); on failure it re-arms for the next tick and returns (never blocks on the serializer, so callout_stop under the serializer always completes; alc_stop's STOP unloads the racing re-arm — validated live by the replica's stop_try control: callout_stop returned, pending=0).

DF-3760 — VERDICT

Status: mechanism PROVEN on the guest kernel by deterministic replica of if_alc.c's exact callout/serializer protocol; alc-specific runtime hardware-gated → inconclusive per family convention (DF-3715 precedent), reproduced=0, impact=none-on-this-guest. Class of impact when it fires on alc hardware: permanent kernel deadlock (DoS) triggered by a privileged local user (ifconfig down/MTU/detach/suspend).

Root cause (path:line)

1. sys/dev/netif/alc/if_alc.c:1353 — callout_init_mp(&sc->alc_tick_ch): the tick runs on a softclock thread and manages locking by hand.
2. sys/dev/netif/alc/if_alc.c:3414 — alc_tick() does a blocking lwkt_serialize_enter(ifp->if_serializer); :3428 — self re-arm callout_reset(&sc->alc_tick_ch, hz, alc_tick, sc) inside the serialized section.
3. sys/dev/netif/alc/if_alc.c:3973 — alc_stop() calls callout_stop(&sc->alc_tick_ch) while holding the same serializer (ASSERT_SERIALIZED(ifp->if_serializer) at :3965).
4. sys/kern/kern_timeout.c:1091 — callout_stop() is the synchronous variant on this kernel (_callout_cancel_or_stop(..., sync=1)); with the callback INPROG the caller ssleep(c, &c->spin, 0, "costp", 0) (sys/kern/kern_timeout.c:923) until the callback completes.
5. ⇒ A tick callback dequeued and parked in lwkt_serialize_enter (if_alc.c:3414) on the serializer held by the alc_stop() caller deadlocks against the stopper (AB-BA): both threads wedge permanently. Collateral: the interface serializer is held forever (all later driver paths on that interface block — ioctls, RX/TX interrupt, tick) and the wedged softclock thread stops delivering every callout on its CPU.

Callers of alc_stop holding the serializer: alc_init (sys/dev/netif/alc/if_alc.c:3580; reached from alc_ioctl SIOCSIFFLAGS up :2824/down :2826, watchdog :2774/:2779, and alc_intr DMA-error reinit :3087/:3103 — the latter from the interrupt thread), alc_detach (:1616, serializer entered at :1615), alc_suspend (:2437).

Race window: the tick must be INPROG at the moment the stopper is between its serializer acquire and callout_stop(). That window includes alc_stop's register writes plus ≥1 ms of DELAYs (:3984, :4040, :4103), the tick period is 1 s → ≈0.1–1% per stop, but the trigger (ifconfig alc0 down, MTU change, detach, suspend/resume) is repeatable by root, making eventual occurrence plausible on long-lived boxes. The alc_intr path (:3103) shows the same AB-BA can be entered from the interrupt thread when the DMA-error bit latches while a tick is parked.

This is the if_alc.c instance of the class proven for if_em.c as DF-3715; identical primitives, independent file, not previously filed for alc.

Not a re-arm UAF

DF-3715's replica (same kernel) proved the negative control: after the callback returns, callout_stop's STOP post-processing unloads a racing re-arm (_callout_update_spinlocked, pending=0). So there is no post-stop re-arm UAF here — the defect is purely the sync-wait deadlock. Re-verified for the alc/fix shapes by this pack's stop_try control.

Verification performed (guest, DragonFly 6.5-DEVELOPMENT x86_64)

alc_callout_replica.ko (out-of-tree kmodule replicating if_alc.c's exact protocol: blocking-enter + hz self re-arm "shipped shape", and try-enter + 1-tick retry "fix shape"):

• build: cd /root/kmod && make — clean with -Werror (build.log).
• stop_try (fix-shape control, run FIRST): under the serializer, callout_stop returned immediately and pending=0 — the DF-3760 fix.diff mechanism is validated live on this kernel.
• stop_blk (shipped shape, backgrounded): dmesg stops exactly at alcreplica[blk]: IF THIS IS THE LAST alcreplica LINE, THE if_alc.c AB-BA DEADLOCK IS PROVEN — callout_stop() never returned (run.log + serial console). Second-session ps: 1334 D5 costp sysctl kern.alcreplica.stop_blk=1 — D-state, wchan costp == sys/kern/kern_timeout.c:923, i.e. the alc_stop()-shaped caller permanently stuck inside callout_stop() holding the serializer while the alc_tick()-shaped callback is parked in lwkt_serialize_enter. Guest wedged (a follow-up ssh session on the wedged instance hung; a fresh one worked for ps), then vm.sh reset with-src → clean boot (env.txt captured on the fresh instance: no Atheros PCI device, ifconfig -l = vtnet0 lo0, NO_ALC_KLD, no hw.alc sysctl; /boot/kernel/if_alc.ko exists only as a module file) → the alc-specific instance is hardware-gated.
• Guest /usr/src copy of if_alc.c byte-identical to the audited tree (md5 fb1a46ef2b2559de4aa5d508e03efcd5).

Fix

fix.diff (git-apply clean against the read-only tree): alc_tick takes the serializer with lwkt_serialize_try(); on failure it re-arms for the next tick (callout_reset(&sc->alc_tick_ch, 1, alc_tick, sc)) and returns — the handler never blocks on the serializer, so alc_stop()'s callout_stop() always makes progress, and its STOP unloads the racing re-arm (validated live by stop_try: callout_stop returned, pending=0). Mirrors the DF-3715 fix for if_em.c.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.