DF-3776 — jme_stop()/jme_miibus_statchg() vs jme_tick() AB-BA deadlock (callout subsystem vs driver serializer)

File: sys/dev/netif/jme/if_jme.c (pass 2, GLM 5.3 re-audit) Class: DF-3715 (em) / DF-3738 (emx) / DF-3760 (alc) family — independent jme(4) instance Severity: Medium · CWE: CWE-833 (Deadlock) / CWE-667 · Confidence: certain (source), mechanism PROVEN on guest

What

jme_tick is a self-re-arming 1 Hz callout (pinned to CPU0 via JME_TICK_CPUID, if_jme.c:77/:2881) whose callback blocks in lwkt_serialize_enter(&sc->jme_serialize) (if_jme.c:2571). jme_stop() calls the synchronous callout_stop(&sc->jme_tick_ch) (if_jme.c:2907) while holding all driver serializers (ASSERT_IFNET_SERIALIZED_ALL, if_jme.c:2898). On this kernel callout_stop() → _callout_cancel_or_stop(..., sync=1) ssleeps on "costp" (sys/kern/kern_timeout.c:920) until an in-progress callback finishes — so a tick that fired and parked on the serializer held by the stopper deadlocks both threads permanently, and the wedged CPU0 softclock thread stops delivering every callout queued on CPU0.

Trigger paths (all hold all serializers)

• ifconfig jme0 down / up / mtu / media → jme_ioctl (if_jme.c:1954/:1939/:1965) → jme_stop/jme_init→jme_stop (:2672)
• jme_miibus_statchg callout_stop at :409 (link state change)
• jme_detach (:1092-1093), jme_suspend (:1589-1590)
• jme_watchdog → jme_init (:1885/:1900)
• kldunload/devd detach, system suspend — all root-triggered; window widens arbitrarily when the stopper blocks acquiring the ring serializers behind a busy RX interrupt handler.

Reproduce (guest, no jme hardware needed — protocol replica)

scp findings/poc/DF-3776/{Makefile,jme_callout_replica.c} dfbsd:/root/kmod/
vm.sh run_root 'cd /root/kmod && make && kldload ./jme_callout_replica.ko'
vm.sh run_root 'sysctl kern.jmereplica.arm=1; sleep 2; sysctl kern.jmereplica.stop_try=1'
vm.sh run_root '(sysctl kern.jmereplica.stop_blk=1 &) ; sleep 6; dmesg | grep "jmereplica\[blk\]" | tail -2; ps -o pid,stat,wchan,command -ax | grep stop_blk | grep -v grep'
#   -> "IF THIS IS THE LAST jmereplica LINE, THE if_jme.c AB-BA DEADLOCK IS PROVEN"
#   -> sysctl thread D5 wchan "costp"; callout_stop NEVER returned.
#   Guest is wedged: vm.sh reset with-src to recover.

Expected (observed 2026-09-16, see run.log): fix-shape control returns with pending=0; shipped-shape callout_stop() never returns; ps shows the caller asleep on costp (kern_timeout.c:920).

Fix

fix.diff — try-enter + 1-tick retry in jme_tick (family fix, mirrors DF-3715/DF-3738/DF-3760). Compile-validated: nativekernel rebuild of X86_64_GENERIC with the fix → RC=0, no warnings (fix_build.log). Mechanism validated by the replica's stop_try control.

DF-3776 — VERDICT

Status: mechanism PROVEN on the guest kernel by deterministic replica of if_jme.c's exact callout/serializer protocol; jme-specific runtime hardware-gated → inconclusive per family convention (DF-3715/DF-3738/DF-3760 precedent), reproduced=0, impact=none-on-this-guest. Class of impact when it fires on JMicron JMC250/JMC260 hardware: permanent kernel deadlock (DoS) triggered by a privileged local user (ifconfig down/up/MTU/media, detach, suspend) and opportunistically by the watchdog path; collateral: the CPU0 softclock thread stops delivering ALL callouts queued on CPU0.

Root cause (path:line)

1. sys/dev/netif/jme/if_jme.c:772 — callout_init_mp(&sc->jme_tick_ch); armed at :2881 / :483 with callout_reset_bycpu(..., hz, jme_tick, sc, JME_TICK_CPUID) (CPU0-pinned, if_jme.c:77 "DO NOT CHANGE THIS").
2. sys/dev/netif/jme/if_jme.c:2571 — jme_tick() does a blocking lwkt_serialize_enter(&sc->jme_serialize) (the first/main serializer of sc->jme_serialize_arr[], if_jme.c:733); :2579 — self re-arm callout_reset(&sc->jme_tick_ch, hz, jme_tick, sc) inside the serialized section. The jme_in_tick / jme_serialize_skipmain dance (if_jme.c:362-363/:3971-3982) only manages the additional serializers inside jme_miibus_statchg; the initial blocking enter at :2571 is the deadlock site.
3. sys/dev/netif/jme/if_jme.c:2907 — jme_stop() calls callout_stop(&sc->jme_tick_ch) while holding ALL driver serializers (ASSERT_IFNET_SERIALIZED_ALL at :2898; entered via ifnet_serialize_all from jme_detach :1092-1093, jme_suspend :1589-1590, and every jme_ioctl path — SIOCSIFFLAGS down :1954, SIOCSIFMTU→jme_init :1939→jme_stop :2672, SIOCSIFMEDIA→ jme_miibus_statchg's own callout_stop at :409, watchdog :1885/:1900).
4. sys/kern/kern_timeout.c:1091 — callout_stop() is the synchronous variant on this kernel (_callout_cancel_or_stop(..., sync=1)); with the callback INPROG the caller ssleep(c, &c->spin, 0, "costp", 0) (sys/kern/kern_timeout.c:920) until the callback completes. Callouts execute on the per-CPU softclock N lwkt thread (kern_timeout.c:423), so the blocking lwkt_serialize_enter in the callback legitimately sleeps — that is what parks it.
5. ⇒ A tick callback dequeued by the CPU0 softclock thread and parked in lwkt_serialize_enter (if_jme.c:2571) on the serializer held by the jme_stop() caller deadlocks against the stopper (AB-BA): both threads wedge permanently. Collateral: the interface's serializers are held forever (all later driver entry points block — ioctls, RX/TX interrupts, tick) and the wedged CPU0 softclock thread stops delivering every callout queued on CPU0 (other drivers' timers, protocol timers, taskqueue timeouts).

Race window: the tick must be INPROG at the moment the stopper is between its serializer acquire and callout_stop(). For jme_stop the direct window is small (flag updates at :2903-2905), but it is widened without bound whenever the stopper's ifnet_serialize_all blocks acquiring the ring serializers after taking main — e.g. behind a busy RX interrupt handler performing the unbounded jme_rxeof walk (DF-3778) — while the 1 Hz tick fires and parks. The jme_miibus_statchg path (:409) has a wider intrinsic window: it is reached from mii_mediachg after PHY register DELAY loops. Every trigger (ifconfig jme0 down|mtu|media, detach, suspend, watchdog reinit) is repeatable by root, so eventual occurrence on long-lived boxes is plausible (same analysis as DF-3760/alc).

This is the if_jme.c instance of the class proven for if_em.c (DF-3715), if_emx.c (DF-3738) and if_alc.c (DF-3760); identical primitives, independent file, not previously filed for jme.

Not a re-arm UAF

DF-3715's replica (same kernel) proved the negative control: after the callback returns, callout_stop's STOP post-processing unloads a racing re-arm (_callout_update_spinlocked). No post-stop re-arm UAF — the defect is purely the sync-wait deadlock. Re-verified for the jme/fix shapes by this pack's stop_try control (pending=0 after stop).

Verification performed (guest, DragonFly 6.5-DEVELOPMENT x86_64)

Presence probe (run.log): no JMicron PCI device (vtnet0 lo0 only) — driver present in the running kernel (kldstat -v: 102 jme/miibus, 103 pci/if_jme) but attach never runs without hardware → runtime hardware-gated, honest inconclusive per family convention.

Mechanism, proven by jme_callout_replica.ko (jme_callout_replica.c — replica of jme's exact protocol: MP callout pinned to CPU0, callback = blocking enter of ser_main + jme_serialize_skipmain array dance (array_enter/array_exit from index 1, if_jme.c:3971-3982) + self re-arm at hz; stopper = enter of the full serializer array (all, index 0) + callout_stop):

1. sysctl kern.jmereplica.arm=1 — arms shipped-shape and fix-shape replicas (dmesg: "armed (hz=100)").
2. sysctl kern.jmereplica.stop_try=1 — fix-shape control (DF-3776 fix.diff protocol: lwkt_serialize_try + 1-tick retry): callout_stop returned, pending=0, no deadlock (run.log).
3. sysctl kern.jmereplica.stop_blk=1 — shipped shape: the sysctl thread takes ALL serializers, waits until the tick handler is BLOCKED on the main serializer (fired=16 ran=15), then calls callout_stop(): * last dmesg line = "… THE if_jme.c AB-BA DEADLOCK IS PROVEN" — callout_stop() never returned; * ps -o pid,stat,wchan,command -ax shows the caller 1514 D5 costp sysctl kern.jmereplica.stop_blk=1 (run.log) — D-state, wchan costp == sys/kern/kern_timeout.c:920; * CPU0 softclock thread wedged executing the parked callback (run.log). Guest force-killed afterwards; vm.sh reset with-src restored a clean guest (verified: no /root/kmod, no kern.jmereplica sysctl).

Fix validation

• fix.diff (git-apply clean against sys/) switches jme_tick to lwkt_serialize_try + 1-tick retry (pinned via callout_reset_bycpu to JME_TICK_CPUID), mirroring the DF-3715/DF-3738/DF-3760 family fix.
• Mechanism validated live: the replica's fix-shape control (identical try-enter + retry protocol) shows callout_stop under ALL serializers returns with pending=0, no deadlock (run.log).
• Compile-validated on the guest: all three jme fix.diff files (DF-3776/DF-3777/DF-3778) applied together to /usr/src, incremental nativekernel build of X86_64_GENERIC → RC=0, zero warnings/errors (fix_build.log, 2026-09-16 04:41 UTC).
• Full driver-level validation is not possible on a guest without JMicron hardware → fix_status: not_testable (family convention).

Bottom line

The if_jme.c instance of the proven em/emx/alc AB-BA: jme_tick's blocking serializer acquire under a self-re-arming callout vs callout_stop() under ifnet_serialize_all in jme_stop/statchg. On hardware: permanent kernel deadlock + CPU0 callout blackout from a root-repeatable ioctl (and opportunistically the watchdog path). Fix is one hunk (try-enter + retry), compile-clean, mechanism-proven.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.