DF-4401 — Unguarded tws_reset() re-entry: check-then-act race corrupts the reset state machine (panic / frozen simq)

What

tws_reset() (sys/dev/raid/tws/tws_cam.c:1197-1218) guards re-entry with an unlocked read:

if ( tws_get_state(sc) == TWS_RESET ) {
    return;
}
...
lockmgr(&sc->gen_lock, LK_EXCLUSIVE);
tws_send_event(sc, TWS_RESET_START);   /* KASSERT(state != TWS_RESET), tws.c:666 */
lockmgr(&sc->gen_lock, LK_RELEASE);

Three independent callers can run it concurrently: - tws_timeout ccb-timeout callout (tws_cam.c:1185-1195) — one per queued I/O; - tws_intr_attn_error microcontroller-error interrupt (tws_cam.c:1143-1153); - tws_passthru ioctl thread on ETIMEDOUT (tws_user.c:143-147, holding gen_lock — only survivable because it is LK_CANRECURSE, tws.c:199).

Two threads that both pass the unlocked check both execute the reset prologue:

1. INVARIANTS kernels: the second TWS_RESET_START trips KASSERT(sc->tws_state != TWS_RESET) (tws.c:666) → panic (KASSERT/KKASSERT are compiled in only with INVARIANTS, sys/sys/systm.h:94-122); the second TWS_RESET_COMPLETE later trips tws.c:674 similarly.
2. Production kernels: duplicated xpt_freeze_simq(sc->sim, 1) (tws_cam.c:1212-1214) with only ONE matching xpt_release_simq(...,1) in tws_reinit (:1268-1270) → qfrozen_cnt leaks ≥1 (sys/bus/cam/cam_xpt.c:4852-4888) → the SIM queue stays frozen forever, all I/O on the adapter stalls permanently; plus a duplicated soft reset (tws_assert_soft_reset, :1216) and duplicated reset_cb/reinit callout chains.
3. tws_reinit() (:1241-1281) keeps its retry counters (timeout_val, try) in static storage — shared across all adapters in the system.

Sibling: DF-4336 (twa tw_cl_reset_ctlr has no entry guard) — same defect class carried into the tws CAM layer.

Impact

Local DoS (panic on debug kernels; permanent adapter I/O freeze on production kernels) triggered by controller distress that fires ≥2 of the reset callers near-simultaneously (e.g. two ccb timeouts racing a controller-error interrupt). No privilege needed beyond ordinary I/O to a distressed adapter.

Status

QEMU guest has no 3ware HBA → inconclusive; race proven from source.

VERDICT — DF-4401

Status: inconclusive (hardware-gated). The check-then-act race is certain from source; triggering needs the 3ware controller to be distressed enough that two reset callers overlap.

Proof chain

1. tws_reset entry guard is a plain read: tws_cam.c:1203-1205 if (tws_get_state(sc) == TWS_RESET) return; — no lock held; the state transition happens later under gen_lock at :1207-1209.
2. tws_send_event(TWS_RESET_START) asserts single-entry: tws.c:664-671 KASSERT(sc->tws_state != TWS_RESET, ...); KASSERT panics only on INVARIANTS kernels (sys/sys/systm.h:94-122).
3. Concurrent callers: - ccb timeout callout per I/O: tws_cam.c:807-808 arms tws_timeout, which calls tws_reset (:1191-1194) for every timed-out request; - controller-error interrupt: tws_intr_attn_error → tws_reset (:1143-1153); - passthrough ioctl timeout: tws_user.c:142-147 → tws_reset while holding gen_lock (recursive; tws.c:199). Nothing serializes them before the state check.
4. Production-kernel consequence of a double entry: - xpt_freeze_simq(sc->sim, 1) executed twice (tws_cam.c:1212-1214) vs a single xpt_release_simq(sc->sim, 1) in tws_reinit (:1268-1270): sendq.qfrozen_cnt is a counter (sys/bus/cam/cam_xpt.c:4863-4865), so a leaked increment keeps the devq frozen permanently → every subsequent tws_execute_scsi sees a frozen SIM; disk I/O on the adapter never resumes. - duplicated tws_assert_soft_reset (:1216) and callout chains (:1217, :1238) → duplicated reinit sequences.
5. Multi-adapter defect: tws_reinit's static int timeout_val=0, try=2 (:1246) is shared by every controller instance.

Impact ceiling

Panic (INVARIANTS) or permanent adapter-wide I/O hang (production) — a local denial of service; no info leak or privilege path. Rated Low consistent with DF-4336.

Fix

Serialize tws_reset entry under gen_lock with a re-check after acquisition (fix.diff), and move tws_reinit's retry counters into the softc.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.