DF-5071 Verification Verdict

Severity: Medium · Impact class: dos (unkillable D-state hang, unbounded queue growth) Method: sink-level reproduction on the stock guest kernel (DF-4986/DF-5012/DF-5026 house precedent) + fix compile-validation against the guest's /usr/src.

Verdict: REPRODUCED (dos), fix VALIDATED (behavioral A/B + amr.ko build)

The bug (source chain, all lines verified)

Once AMR_STATE_SHUTDOWN is set (amr_pci_shutdown amr_pci.c:395 or amr_rescan_drives amr.c:466) — or the adapter simply wedges, since amr has no timeout/watchdog anywhere (verified: only a poll-loop timeout at amr.c:1355 exists, for polled commands) — every bio submitted through an already-open disk fd is parked on sc->amr_bioq forever:

• amrd_strategy (amr_disk.c:166-194) checks ONLY sc == NULL; it has no AMR_STATE_SHUTDOWN gate — in the same file amrd_open (amr_disk.c:126-127) refuses new opens with ENXIO in exactly that state. Worse, even that lone gate is bypassed whenever another fd holds the disk open, because diskopen() skips the driver's d_open while a slice ref is open (sys/kern/subr_disk.c:1094) — demonstrated live.
• amr_submit_bio (amr.c:407-416) enqueues (amrvar.h:309) and calls amr_startio, then returns 0.
• amr_startio (amr.c:1155-1188) calls (void)amr_bio_command(sc, &ac) — the return value is IGNORED (amr.c:1171) — and gives up when no command was built (ac == NULL, amr.c:1178): the bio stays queued.
• amr_bio_command (amr.c:1240-1241) returns ENOMEM without dequeuing when amr_alloccmd fails — the steady state on a wedged adapter where every command sits busy forever (nothing completes them: completions only come from the interrupt → amr_done → amr_complete → amr_startio).
• Nothing drains amr_bioq on any shutdown/detach path (amr_pci_shutdown amr_pci.c:387-417, amr_rescan_drives amr.c:454-485, amr_free amr.c:371-400); the comment at amr_pci.c:383 ("we can assume that the bioq on the controller is empty, as we won't allow shutdown if any device is open") is FALSE: AMR_STATE_OPEN is set only by the CONTROL device open (amr.c:430); amrd_open sets nothing. At detach the bioq head is kfreed with bios still on it (feeding the DF-2082 in-flight UAF window).

Consequence: the issuer sleeps in biowait in an unkillable D-state, and the queue grows without bound. Trigger: root kldunload amr / AMR_RESCAN_DRIVES ioctl with I/O queued or in flight, or any adapter wedge/fault. Root-on-amrd wedges the whole machine.

Reproduction (run.log)

• holder process (fd opened BEFORE shutdown) pread after AMR_STATE_SHUTDOWN set → D0/physstr (biowait);
• survives kill -9 (SIGKILL pends; delivered only when the bio is eventually completed);
• released only by the external poke drain (dmesg: poke -- draining 1 parked bio(s) with EIO), process exits with EIO;
• amr_startup (amr.c:294-344, &= ~AMR_STATE_SHUTDOWN at :338) restores normal completion — parking is a direct consequence of the missing gate/drain, not of device removal;
• gate asymmetry: fresh open during shutdown with holder → SUCCEEDS (subr_disk.c:1094 bypass); fresh open without holder → ENXIO (amrd_open :126-127 fires).

Fixed variant (run_ab.log)

Two hunks only (the ones in fix.diff): (1) amrd_strategy fail-fast mirroring amrd_open, (2) drain of queued bios when shutdown is entered. Result: shutdown entered with 4 incidental bios genuinely parked → (fixed) draining 4 parked bio(s) with ENXIO → the held fd's subsequent pread returns immediately r=-1 errno=6 (ENXIO) — no D-state, no residual process, no accumulation.

Fix validation

1. Behavioral A/B at sink level (run.log vs run_ab.log): baseline wedges unkillably; fixed returns ENXIO immediately.
2. Compile validation (fix_validation.log): fix.diff applied to the guest's /usr/src (amr_disk.c + amrvar.h + amr.c + amr_pci.c); make in /usr/src/sys/dev/raid/amr produced amr.ko with -Werror, 0 warnings (patched amr_disk.o in the link line). Sources restored pristine afterwards (grep marker 0).

Hardware gate

The real entry needs a MegaRAID adapter (absent on the QEMU guest); the completion topology is driver-side unconditional control flow, and the identical shape was sink-level reproduced for mfi (DF-5012) and ips (DF-5026) before. Impact ceiling: permanent unkillable-hang DoS for every issuer (whole-system wedge when amrd carries root) on hardware fault, adapter removal, or privileged rescan/unload.

Guest returned to a clean state (modules unloaded, sources pristine, no parked bios): guest_dirty = 0.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.