DF-4192 — pcm chn_trigger() trigger-flag/busy-list race: unprivileged kernel panic + unrecoverable system hang

Discovered during the pass-2 (GLM 5.3) audit of sys/dev/sound/pci/es137x.c, live-verified on the QEMU ES1370 card. The defect is in the pcm core (sys/dev/sound/pcm/channel.c, compiled into sound.ko), not in es137x itself — it is reachable through any pcm sound driver via the 0666 /dev/dsp device.

The bug (sys/dev/sound/pcm/channel.c:2190-2225)

chn_trigger() updates the software trigger flag c->trigger under CHN_LOCK(c), then releases the channel lock before taking PCM_LOCK(d) to insert/remove c from the per-device channels.pcm.busy list:

case PCMTRIG_START:
        if (c->trigger != PCMTRIG_START) {
                c->trigger = go;            /* flag flips HERE   */
                CHN_UNLOCK(c);              /* ---- window ----  */
                PCM_LOCK(d);
                CHN_INSERT_HEAD(d, c, channels.pcm.busy);  /* list HERE */
                ...
case PCMTRIG_STOP:
case PCMTRIG_ABORT:
        if (c->trigger == PCMTRIG_START) {
                c->trigger = go;
                CHN_UNLOCK(c);
                PCM_LOCK(d);
                CHN_REMOVE(d, c, channels.pcm.busy);       /* SLIST walk */

Two threads issuing SNDCTL_DSP_SETTRIGGER START/STOP concurrently on the same fd (same pcm channel — dsp.c serializes per channel only via CHN_LOCK, which chn_trigger drops mid-call) desynchronize the flag from list membership:

• Thread B (STOP) wins PCM_LOCK before thread A (START) inserted c: CHN_REMOVE = SLIST_REMOVE walks while (SLIST_NEXT(curelm) != c) past the end of the list → curelm = NULL → NULL->sle_next at offset 0x138.
• Interleaved insert/remove on a non-empty list builds a cycle → the same walk spins forever in kernel mode holding the channel lock, wedging every subsequent dsp/mixer user (they pile up in lockmgr_exclusive).

DFly ships NULL-safe variants (CHN_INSERT_HEAD_SAFE / CHN_REMOVE_SAFE, channel.h:193-221) but chn_trigger does not use them.

Making the guest attackable (QEMU audio)

The audit guest boots headless with no sound hardware. Boot it with a temporary launcher (vm.sh untouched — DF-3879 pattern):

qemu-system-x86_64 -enable-kvm -m 4096 -smp 6 \
  -drive file=disk.qcow2,if=virtio,format=qcow2 \
  -netdev user,id=n0,hostfwd=tcp:127.0.0.1:5522-:22 \
  -device virtio-net-pci,netdev=n0 \
  -audiodev none,id=snd0 -device ES1370,audiodev=snd0 \
  -display none -monitor unix:boot-mon.sock,server,nowait \
  -serial unix:/tmp/ser.sock,server=on,wait=off -daemonize

In the guest: kldload snd_es137x → pcm0: <AudioPCI ES1370> and /dev/dsp, /dev/mixer appear 0666 root:wheel.

Build (on the guest, as any user)

cc -O2 -pthread -o /tmp/trighammer /tmp/trighammer.c

Run (unprivileged)

/tmp/trighammer 30          # 6 threads: 4× SETTRIGGER START/0 race,
                            # SETFRAGMENT/SPEED churn, read/write I/O

Success criterion (baseline, stock sound.ko): * kernel panic Fatal trap 12 ... fault virtual address = 0x138 at chn_trigger+0x263 (movq 0x138(%rdx),%rax, rdx==NULL) — see panic.txt; typically within 10-60 s, and * alternatively/intermittently the whole system hangs silently: ssh dies, serial stops; NMI into DDB shows a CPU spinning at chn_trigger+0x26a (cmpq %rbx,%rax) inside the same SLIST walk, with every dsp/mixer client blocked behind it (ddb_blocked_stacks.txt).

With the patched module (fix.diff): no panic, no system wedge across

10 min of hammering; the PoC process itself can still end up blocked in a dsp ioctl (residual flag/state desync — see VERDICT.md "Fix validation").

es_batt.c is the wider 5-process OSS ioctl battery that first triggered the hang (mixer dev 0..255, SETFRAGMENT extremes, speed 0..0x7fffffff, format storm, open/close churn).

DF-4192 — VERDICT (pass 2, GLM 5.3; audit target sys/dev/sound/pci/es137x.c, defect in pcm core)

VERDICT: REPRODUCED — unprivileged local kernel panic AND unrecoverable system-wide hang via SNDCTL_DSP_SETTRIGGER race in chn_trigger(). confidence: certain. impact: panic (availability-only; no corruption primitive beyond the NULL-offset read at fault VA 0x138 — the SLIST walk's pointer write only ever targets valid list nodes).

TIMELINE (all on DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC, QEMU 7.2 KVM, -device ES1370, kldload snd_es137x):

1. Baseline battery (es_batt.c, 5 processes as user "maxx", stock sound.ko md5 c4a52a5bab2572173ead879d9869a53c): * Run 1: full system wedge ~90-120 s in. ssh dead, serial frozen, QEMU at ~143% host CPU. NMI into DDB: "Stopped at chn_trigger+0x26a: cmpq %rbx,%rax" — CPU0 spinning inside the CHN_REMOVE predecessor walk, holding the channel lock. * Run 2: partial wedge. DDB ps: five es_batt threads sleeping on wchan pcm0 (lockmgr_exclusive) reached from dsp_open, mixer_ioctl, dsp_ioctl (ddb_blocked_stacks.txt) — everything queued behind the stuck lock holder.
2. Focused repro (trighammer.c: 4 threads racing SETTRIGGER START/PCM_ENABLE_ALL vs 0 on one shared fd + SETFRAGMENT/SPEED + r/w I/O, unprivileged): kernel panic within ≤60 s on the first run — panic.txt: Fatal user address access from kernel mode from trighammer Fatal trap 12: page fault while in kernel mode fault virtual address = 0x138 instruction pointer = 0x8:0xffffffff82644233 (chn_trigger+0x263) current process = 953 0x138 is the offset of the channels.pcm busy-list link inside struct pcm_channel; rdx==NULL is the SLIST_REMOVE walk cursor that ran off the end of the list (the channel being "removed" was never inserted — its inserter was preempted in the CHN_UNLOCK window at channel.c:2199-2201).

ROOT CAUSE: sys/dev/sound/pcm/channel.c:2190-2225 — the software trigger flag c->trigger is flipped under CHN_LOCK(c), but the corresponding insert/remove on d->channels.pcm.busy happens after dropping CHN_LOCK and taking PCM_LOCK(d). A concurrent SNDCTL_DSP_SETTRIGGER on the same channel (dsp.c serializes on CHN_LOCK only) interleaves the two halves: * STOP-before-insert → SLIST_REMOVE walks past list end → NULL deref at link offset (panic; fault VA 0x138 proves the exact field). * interleaved insert/remove on a non-empty list → cyclic list → the same walk spins forever in kernel mode with preemption, holding the channel lock → silent total system hang (wedge samples at chn_trigger+0x26a and +0x263). The NULL-safe list macros CHN_INSERT_HEAD_SAFE / CHN_REMOVE_SAFE already exist in channel.h:193-221 but were used nowhere.

ES137X SPECIFICS: the driver is only the delivery vehicle; the race is in the framework and applies to every pcm driver (verified reachability via the QEMU-emulated ES1370, /dev/dsp mode 0666). es137x's own ioctl surface (mixer register indices via mixtable[], fragment/rate arithmetic, ring sizing) survived the full battery without a single driver-local fault — see the file's negative notes in the audit result.

EXPLOIT CHAIN: none worth pursuing — availability only. The corruption window writes pointer values only into valid list nodes; the wild access is a read at a fixed offset from NULL. No path to uid=0 identified; the value of this bug is denial of service (panic or permanent hang requiring power cycle, from any local user, on default-config machines with audio).

FIX VALIDATION: * Baseline reproduced: YES (panic + wedge, above). * Patched module: sound.ko rebuilt on the guest from /usr/src/sys with CHN_INSERT_HEAD_SAFE + CHN_REMOVE_SAFE substituted at channel.c:2201 and 2218 (fix.diff; module md5 0d076339abf53061007aa1deeecedfd7 installed to /boot/kernel/sound.ko; fix_build.log). * Re-run of the exact PoC on the patched module: NO panic and NO system wedge across >10 minutes of hammering (3×60 s trighammer + 30 s + battery attempts; serial log zero "Fatal trap"; DDB samples show idle CPUs, not chn_trigger spins) — fix_patched_reproduced=0 (the bad behavior is GONE). * Residual (noted honestly): post-fix, the PoC process itself can still fail to exit — a thread ends up blocked in a dsp ioctl (join never returns). The _SAFE macros prevent the memory fault and the list cycle, but the flag/list desync itself remains; a full fix needs the trigger transition to be made atomic w.r.t. the busy list (e.g., do list bookkeeping while holding PCM_LOCK across the flag check, or track list membership explicitly). Availability impact of the residual is process-local, not system-wide.

ENVIRONMENT: dfbsd-qemu/disk.qcow2 @ with-src snapshot; launcher with -audiodev none,id=snd0 -device ES1370,audiodev=snd0; guest kldload snd_es137x (snd_es137x.ko from /boot/kernel); /dev/dsp + /dev/mixer 0666. Guest left clean: vm.sh revert with-src + vm.sh up (no audio device).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.