DF-4271 — wb_stop()/wb_detach() use non-interlocked callout_stop() against a self-re-arming wb_tick → post-detach UAF

Files: sys/dev/netif/wb/if_wb.c:1590 (callout_stop in wb_stop), :839-846 (detach under serializer), :1191-1201 (wb_tick).

What

static void
wb_tick(void *xsc)
{
        ...
        lwkt_serialize_enter(ifp->if_serializer);      /* :1197 - self-serializing */
        mii_tick(mii);
        callout_reset(&sc->wb_stat_timer, hz, wb_tick, sc);   /* :1199 - re-arms itself */
        lwkt_serialize_exit(ifp->if_serializer);
}

wb_stop() (serialized context) calls callout_stop(&sc->wb_stat_timer) (:1590) only. Per sys/kern/kern_timeout.c (callout_stop documentation for non-lock-aided callouts — wb uses plain callout_init(), :715): "Stops a callout if it is pending or queued, does not block. This function does not interlock against a callout that is in-progress."

Detach sequence (:839-850): lwkt_serialize_enter → wb_stop() (cancels pending timer, does NOT wait) → bus_teardown_intr → lwkt_serialize_exit → ether_ifdetach → device_delete_child(miibus) → bus_generic_detach → resources released → return (softc freed by newbus).

Race

1. wb_tick fires on CPU1 and blocks in lwkt_serialize_enter (the detach path on CPU0 holds the serializer).
2. CPU0: wb_stop → callout_stop (pending cancelled; in-progress callback not interlocked) → releases serializer → completes teardown → softc freed.
3. CPU1: wb_tick acquires the serializer, calls mii_tick() on the wb_miibus child being/mostly deleted (:1198), then callout_reset(&sc->wb_stat_timer, ...) re-arms a callout living in the freed softc.
4. One second later the callout fires on freed memory: wb_tick(sc) reads sc->wb_miibus out of freed kernel memory and dereferences it — a persistent use-after-free (read/write through freed softc every hz), crash or worse depending on slab reuse.

Trigger

Driver detach with the interface up: kldunload if_wb.ko, devctl removal, or cardbus eject on machines with the W89C840F/RL100-ATX NIC. Privileged unload; hardware-gated. Window is one tick (hz) but the re-arm makes it persistent once lost.

Fix

callout_drain(&sc->wb_stat_timer) in wb_detach after the serializer is released (draining while holding the serializer would deadlock against wb_tick's own serialize_enter, so drain after exit) — see fix.diff.

VERDICT - DF-4271 (callout_stop does not interlock with in-progress, self-re-arming wb_tick)

Status: untested - no W89C840F NIC in the guest (env.txt); the race is established from the DragonFly callout API contract, which is explicit:

sys/kern/kern_timeout.c (callout_stop, non-lock-aided callouts): "Stops a callout if it is pending or queued, does not block. This function does not interlock against a callout that is in-progress."

wb's callout is plain callout_init() (if_wb.c:715) — non-lock-aided.

Why the race is real

• wb_tick (:1191-1201) self-serializes (lwkt_serialize_enter at :1197) and self-re-arms (callout_reset at :1199) — both under the serializer.
• wb_stop() runs under the serializer too (from wb_init/ioctl/intr/detach) and issues only callout_stop() (:1590), which by contract cannot wait for a callback that is blocked at :1197 waiting for the very serializer the stopper holds.
• Detach releases the serializer at :843 and continues teardown (ether_ifdetach, miibus child deletion at :848-849, resource release, softc free by newbus after device_detach returns).
• The pending callback then proceeds: mii_tick on a deleted/being-deleted miibus child, and callout_reset re-arming a timer embedded in memory that is about to be (or already is) freed. The re-arm guarantees the UAF repeats every hz until the freed callout state happens to be overwritten.

Impact

Use-after-free (read + indirect call chain through freed softc) after driver detach on hardware-bearing systems; privileged trigger (kldunload/device removal). Severity Low: small window, privileged trigger, hardware-gated — but the consequence is an unbounded repeating UAF, not a one-shot.

Fix validation

Not possible on this guest (no hardware). fix.diff adds the drain on the correct side of the serializer release; draining while holding the serializer would self-deadlock (wb_tick needs the serializer to finish), hence the placement after :843.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.