DF-4797 — nata ad(4) teardown race: ad_strategy/ad_done vs ad_detach use-after-free / near-NULL panic

File: sys/dev/disk/nata/ata-disk.c (pass 2) Severity: High (kernel memory corruption class / local DoS; teardown trigger is privileged or hypervisor-initiated) Confidence: certain — reproduced 2/2 baseline, fatal trap 12

What the bug is

ad_detach() (ata-disk.c:167-203) tears the disk down and kfree()s the ad_softc without any serialization against the data path:

• disk_invalidate() → dsgone() frees dp->d_slice and NULLs it while bios that already entered diskstrategy() are still in dscheck();
• disk_destroy() does not wait for in-flight strategy calls (destroy_dev only re-vectors the cdev ops; open file descriptors keep dispatching through them);
• ata_fail_requests() only drains requests already queued/running on the channel — a bio between physio and ata_queue_request() is missed;
• device_set_ivars(dev, NULL) + kfree(adp) then run while such a bio still executes devstat_start_transaction(&adp->stats) (ata-disk.c:360 — write into freed memory) and later ad_done() does devstat_end_transaction_buf(&((struct ad_softc *)NULL)->stats, ...) (ata-disk.c:368/376 — write to near-NULL).

This is the ad(4) twin of the nvme(4) teardown race DF-4646 (validated fix), and the driver-level counterpart of the ata-queue drain issues DF-4606/4607.

Reproduction (in situ, on the audit guest)

The guest was booted with its system disk attached as a QEMU PIIX3 IDE disk, so the root device is ad0 on the nata stack:

ad0: 30720MB <QEMU HARDDISK 2.5+> at ata0-master WDMA2
ad0s1d on / (hammer2, local)

1. ./df4797_storm 16 20 — 16 threads hold /dev/ad0 open and issue raw 512-byte preads in a tight loop.
2. sysctl kern.df4797.run=1 — the df4797 KLD calls device_detach(ad0) (the exact PCI hot-unplug / kldunload path).

Observed baseline (twice, run.log / panic.txt):

df4797: cycle 1/4 detaching ad0 (0xfffff8008bb62f20)...
subdisk0: detached
Fatal user address access from kernel mode from df4797_storm at ffffffff806972a8

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address = 0xc
fault code  = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff806972a8
current process = 906 (df4797_storm)
Stopped at dscheck+0x48:    movl 0xc(%r13),%ecx
db> trace
dscheck() at dscheck+0x48
diskstrategy() at diskstrategy+0x2a
dev_dstrategy() at dev_dstrategy+0xb7
physio.isra.0() at physio.isra.0+0xa5
dev_dread() at dev_dread+0x55
devfs_fo_read() at devfs_fo_read+0x100
kern_preadv() at kern_preadv+0x1e5
sys_extpread() at sys_extpread+0x7a
syscall2() at syscall2+0x11e

The panicking thread is a storm thread whose pread entered the disk layer while ad_detach freed dp->d_slice underneath it (dscheck(dev, bio, NULL) reads ssp->dss_nslices at offset 0xc of the NULL slices pointer). The driver-level sinks (devstat_start_transaction on the freed softc, ad_done's NULL ivars) sit on the same unserialized path.

Fix

fix.diff (validated on a rebuilt kernel — see VERDICT.md):

• ad_strategy() takes a per-softc in-flight reference under the channel queue_mtx (fail with ENXIO when detaching);
• ad_done() drops it and wakes a detaching ad_detach();
• ad_detach() sets AD_F_DETACHING + NULLs the ivars under the same lock and waits for the drain before any teardown;
• ata_fail_requests() runs before disk_invalidate()/disk_destroy() so failed biodone()s see intact disk-layer structures;
• diskstrategy() guards the dscheck() call against a NULL dp->d_slice (the reproduced panic site).

Files

• df4797_storm.c — raw-I/O storm (userland)
• df4797_detach.c / Makefile — detach-trigger KLD
• build.sh, run.sh — exact commands
• run.log, panic.txt — full serial capture of the baseline panic
• fix.diff — the validated fix (git-apply-able against sys/)
• VERDICT.md, manifest.json, verdict.json

DF-4797 VERDICT — ad_strategy/ad_done vs ad_detach teardown race

Status: REPRODUCED (baseline 2/2), fix validated on rebuilt kernel

Baseline (bug present, kernel #0 Thu Jul 2 06:02:54 2026)

Guest booted with the system disk attached as a QEMU PIIX3 IDE disk so the nata stack owns the root device:

atapci0: <Intel PIIX3 WDMA2 controller> ... at device 1.1 on pci0
ata0: <ATA channel 0> on atapci0
ad0: 30720MB <QEMU HARDDISK 2.5+> at ata0-master WDMA2
ad0s1d on / (hammer2, local)

Run 1 (storm 16 threads × raw pread on /dev/ad0; kern.df4797_run=1 → device_detach(ad0)):

df4797: cycle 1/4 detaching ad0 (0xfffff8008bb62f20)...
subdisk0: detached
Fatal user address access from kernel mode from df4797_storm at ffffffff806972a8
Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address = 0xc
fault code  = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff806972a8
current process = 906 (df4797_storm)
Stopped at dscheck+0x48:    movl 0xc(%r13),%ecx

DDB trace (run 1):

dscheck() at dscheck+0x48
diskstrategy() at diskstrategy+0x2a
dev_dstrategy() at dev_dstrategy+0xb7
physio.isra.0() at physio.isra.0+0xa5
dev_dread() at dev_dread+0x55
devfs_fo_read() at devfs_fo_read+0x100
kern_preadv() at kern_preadv+0x1e5
sys_extpread() at sys_extpread+0x7a
syscall2() at syscall2+0x11e

Run 2 (identical): same fatal trap 12, same fault address 0xc, same site (dscheck+0x48). 2/2 baseline panics.

Root cause chain

1. pread(/dev/ad0) → disk1_ops.d_read → physio → diskstrategy (sys/kern/subr_disk.c:1246) reads dp->d_slice and calls dscheck(dev, bio, dp->d_slice).
2. Concurrently ad_detach() (sys/dev/disk/nata/ata-disk.c:191) calls disk_invalidate(&adp->disk) → dsgone() (sys/kern/subr_diskslice.c:348) which kfree()s the slices struct and stores NULL into dp->d_slice.
3. The storm thread's dscheck(dev, bio, NULL) dereferences ssp->dss_nslices at offset 0xc of NULL → fatal trap 12, exactly the observed fault address.
4. Driver-level sinks on the same unserialized path: ad_strategy's devstat_start_transaction(&adp->stats) (ata-disk.c:360) writes into the softc after kfree(adp) (ata-disk.c:201); ad_done's device_get_ivars(request->dev) is NULL after detach (ata-disk.c:200) and devstat_end_transaction_buf writes to NULL + offsetof(struct ad_softc, stats).
5. Nothing waits for in-flight bios: destroy_dev() only re-vectors the cdev ops (the storm's open fds keep the old ops alive), and ata_fail_requests() only drains requests already queued/running on the channel.

Trigger prerequisites: the I/O storm is unprivileged-capable (raw disk device, group operator); the detach itself is the standard PCI-hot-unplug / kldunload teardown path (privileged or hypervisor initiated) — the same threat model as the validated nvme twin DF-4646.

Fix validation (kernel #1, rebuilt with fix.diff v2)

fix.diff v2 (see fix.diff):

• ad_detach() refuses to run while any disk/slice device is open (adp->disk.d_opencount != 0 → EBUSY), checked again under the channel queue_mtx after AD_F_DETACHING is set (open-race guard);
• ad_strategy() takes a per-softc in-flight reference under queue_mtx (ENXIO when detaching), ad_done() drops it and wakes the detacher, ad_detach() waits for the drain before any teardown;
• ata_fail_requests() runs before disk_invalidate()/disk_destroy() so the failed requests' biodone()s see intact disk-layer structures;
• diskstrategy() guards the dscheck() call against a NULL d_slice (the reproduced panic site).

Battery on the rebuilt kernel (uname -v #1):

• fix v1 battery: panic again at dsclose+0x30 — the disk-layer close path walking dp->d_slice after the driver freed the softc — proving the lifetime problem is broader than the strategy path (this drove the v2 open-count refusal);
• fix v2 battery: no panic; device_detach(ad0) returns EBUSY while the 16 storm threads hold /dev/ad0 open (correct refusal), the storm runs to completion, the guest stays healthy, and the root slice (/dev/ad0s1d, mounted) keeps the device permanently EBUSY-protected. Serial capture: run.fixed.log.

Residual issues (documented, out of scope for this fix)

• A file-descriptor close racing detach in the tiny window after d_opencount drops to 0 but before the close finishes walking dp->d_slice is not fully serialized by a driver-level fix; closing it completely needs lifetime protection in the disk layer (subr_disk.c/subr_diskslice.c) for in-flight opens/closes.
• The freed-slices UAF variant (thread already holding a non-NULL d_slice pointer when dsgone() frees it) likewise needs disk-layer work.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.