DF-5110
SATA hotplug connect tasks are unsynchronized and never drained at channel teardown: racing ATTACH/DETACH tasks yield NULL-softc panic or duplicate disk children
Summary
Every PHY-changed interrupt allocates an independent task on the per-CPU taskqueue - nothing serializes two tasks (concurrent on different CPUs) and no nata detach path drains pending ones: teardown frees+NULLs the softc so the task body NULL-derefs, and racing ATTACH/ATTACH both run ata_add_child creating duplicate disk children. Hardware-triggered (PHY flap or admin kldunload racing hotplug) - no unpriv trigger. Softc-NULL guard + teardown-drain fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5110 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5110
Confirmed kernel references
Detail
Evidence (decisive lines)
code-level proof: per-event taskqueue enqueue, absent drain, subr_bus.c:1943-1945 softc free
Verified recommended fix
softc-NULL guard in the task body + taskqueue drain in channel detach (or single per-channel task with generation counter)
Verdict
untested (hardware-triggered: SATA PHY flap; no guest-reachable trigger)
No comments yet.