DF-4112 — nge(4): callout AB-BA deadlock — nge_tick blocks on the serializer nge_stop stops the callout under

What this is

sys/dev/netif/nge/if_nge.c arms sc->nge_stat_timer with a plain callout_init() (if_nge.c:731) — MP-safe on this kernel (sys/kern/kern_timeout.c:770) — and re-arms it every hz from nge_init (if_nge.c:1717). The callback, nge_tick() (if_nge.c:1366-1406), takes the driver serializer by blocking (lwkt_serialize_enter(ifp->if_serializer), if_nge.c:1372 → parks in tsleep "slize", sys/kern/lwkt_serialize.c:227-237) and re-arms itself inside the serializer (if_nge.c:1403).

nge_stop() (if_nge.c:2094) calls callout_stop(&sc->nge_stat_timer) while its caller holds that same serializer (nge_stop is reached under the serializer from nge_ioctl if_nge.c:2031, nge_init :1716, nge_watchdog :2067, nge_detach :934, and nge_intr :1491 — the latter is the interrupt thread itself).

DragonFly's callout_stop() synchronously waits for an in-progress callback (ssleep "costp", sys/kern/kern_timeout.c:920,1091). A callback parked on the stopper's serializer deadlocks against it: both threads wedge permanently, the interface serializer is never released, and the parked softclock thread stops delivering all callouts for its CPU. Same mechanism as DF-3715 (em(4)); re-proven here with the exact nge shape.

Build / run (verification on the audit guest)

# guest has no nge(4)/DP83820 hardware (vtnet0 lo0 only), so the driver
# protocol is replicated verbatim by an out-of-tree module.

scp tlnge_replica.c Makefile root@guest:/root/kmod/
vm.sh run_root 'cd /root/kmod && make'
vm.sh run_root 'kldload /root/kmod/tlnge_replica.ko; sysctl kern.ngereplica.arm=1; sleep 3; \
                (sysctl kern.ngereplica.stop_blk=1 >/dev/null 2>&1 &); sleep 6; \
                dmesg | grep "replica\[nge\]" | tail -3; \
                ps -o pid,stat,wchan,command -ax | grep stop_blk | grep -v grep'

Expected / observed

• dmesg ends with replica[nge]: handler PARKED on our serializer (fired=8 ran=7) - entering callout_stop() then the marker — and nothing after (permanent).
• stopper thread D5, wchan costp (kern_timeout.c:920).
• Fix-shape control (stop_fix: try-enter + 1-tick retry, the proposed fix): callout_stop under the serializer returns, pending=0, firing fully stalled — fix mechanism validated on this kernel.
• On real nge(4) hardware the trigger is ifconfig nge0 down / MTU change / detach / link-watchdog reinit racing the 1-second tick.

Trigger on hardware

ifconfig nge0 down (SIOCSIFFLAGS), SIOCSIFMTU reinit, kldunload if_nge, nge_watchdog recovery, or an unwanted interrupt while the interface is down (nge_intr → nge_stop directly, if_nge.c:1490-1493) — racing the once-per-second nge_tick.

DF-4112 — VERDICT

Finding: nge(4) nge_tick callout callback blocks on the driver serializer (lwkt_serialize_enter, sys/dev/netif/nge/if_nge.c:1372) while nge_stop() calls the synchronous callout_stop(&sc-> nge_stat_timer) (if_nge.c:2094) holding that same serializer — AB-BA deadlock, the DF-3715 (em(4)) family.

Status: inconclusive per the family convention (target hardware absent — guest has vtnet0 lo0 only, no NS DP83820/83821), with the mechanism PROVEN deterministically on the guest kernel by a replica module reproducing the exact nge protocol:

• callout created with plain callout_init() (as if_nge.c:731; MPSAFE on this kernel per sys/kern/kern_timeout.c:770),
• period hz (as if_nge.c:1717),
• callback does a blocking lwkt_serialize_enter (if_nge.c:1372 → tsleep "slize", sys/kern/lwkt_serialize.c:227-237) and re-arms itself inside the serializer (if_nge.c:1403),
• stopper takes the serializer (as every nge_stop caller does: nge_ioctl if_nge.c:2031, nge_init :1716, nge_watchdog :2067, nge_detach :934, and nge_intr :1491 — interrupt-thread context included), waits for the handler to park, then callout_stop() (if_nge.c:2094 → kern_timeout.c:1091 sync wait, ssleep "costp" at :920).

Observed on the guest (DragonFly 6.5-DEVELOPMENT x86_64):

replica[nge]: handler PARKED on our serializer (fired=8 ran=7) - entering callout_stop()
replica[nge]: IF THIS IS THE LAST replica LINE, AB-BA DEADLOCK IS PROVEN
989 D5  costp  sysctl kern.ngereplica.stop_blk=1     <- never returns

• callout_stop() never returned; follow-up session hung because even sysctl reads block against the wedged writer's sysctl lock.
• Fix-shape control: the proposed fix (lwkt_serialize_try + 1-tick retry) is fully stopped by callout_stop() under a held serializer on this exact kernel (pending=0, firing stalled) — fix mechanism validated.
• Post-wedge guests could not be shut down cleanly (force-kill required) — on hardware this is an un-shutdown-able system.

Why hardware-gated: nge(4) attaches only to PCI_VENDOR_NS / PCI_PRODUCT_NS_DP83820 (if_nge.c:140-144); this guest has none.

Exploit chain / impact: not a corruption primitive. A privileged local user (ifconfig down/up, MTU change, kldunload if_nge) racing the 1-second tick — or simply an interrupt arriving while the interface is admin-down (nge_intr → nge_stop, if_nge.c:1490-1493) — permanently wedges threads, a CPU's callout delivery, the interface serializer, and the sysctl subsystem.

Fix: nge_tick() must not block: lwkt_serialize_try() with a 1-tick callout_reset retry (fix.diff). Fix mechanism validated on the guest; patched driver itself not exercisable without hardware → fix_status not_tested.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.