β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5110

SATA hotplug connect tasks are unsynchronized and never drained at channel teardown: racing ATTACH/DETACH tasks yield NULL-softc panic or duplicate disk children

Summary

Every PHY-changed interrupt allocates an independent task on the per-CPU taskqueue - nothing serializes two tasks (concurrent on different CPUs) and no nata detach path drains pending ones: teardown frees+NULLs the softc so the task body NULL-derefs, and racing ATTACH/ATTACH both run ata_add_child creating duplicate disk children. Hardware-triggered (PHY flap or admin kldunload racing hotplug) - no unpriv trigger. Softc-NULL guard + teardown-drain fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5110 Β· 1 files
FileTypeDescriptionSize
verdict.json file 1.2 KB view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5110

Confirmed kernel references

Detail

Evidence (decisive lines)

code-level proof: per-event taskqueue enqueue, absent drain, subr_bus.c:1943-1945 softc free

Verified recommended fix

softc-NULL guard in the task body + taskqueue drain in channel detach (or single per-channel task with generation counter)

Verdict

untested (hardware-triggered: SATA PHY flap; no guest-reachable trigger)