DF-5172 — vcdstrategy() drains sc->bio_queue with no serialization (latent race)

vkernel virtual CD-ROM driver — sys/dev/virtual/vkernel/cdrom/vcd.c

What

vcdstrategy() (vcd.c:148-149) manipulates sc->bio_queue with bioqdisksort() (sorted TAILQ insertion, sys/kern/subr_disk.c:1353) and bioq_takefirst() (sys/sys/buf2.h:167) with no lock, crit section, or cothread — and then performs a blocking pread/pwrite inside the drain loop, which holds the queue open for the full duration of the host I/O. Two concurrent strategy calls on different vCPUs would corrupt the TAILQ (lost/double-removed bios → double biodone → buffer-cache state corruption inside the vkernel process).

The vdisk sibling was reworked precisely to fix this shape: vkd moved all queue manipulation under cothread_lock() (vdisk.c:228-231, 250-255, 279-298). vcd never got the rework.

Why it is only latent (the shield, verified)

vcd_ops is declared { "vcd", 0, D_DISK } — without D_MPSAFE (vcd.c:66-73). For any device whose ops lack D_MPSAFE, dev_dstrategy() takes the global kernel lock around the strategy call:

dev_needmplock()  =>  (dev->si_ops->head.flags & D_MPSAFE) == 0   /* kern_device.c:119-121 */
...
if (needmplock) get_mplock();                                     /* kern_device.c:384 */
(void)dev->si_ops->d_strategy(&ap);
if (needmplock) rel_mplock();                                     /* kern_device.c:388 */

So today every vcdstrategy() call on the system executes under the mplock — concurrent entries are impossible and the unlocked bio_queue cannot be raced. Exactly like DF-5010's dscheck shield, this is an external, incidental guard: the day someone marks vcd D_MPSAFE (the usual modernization step for vkernel drivers — note the mplock is a known scalability bottleneck), the race goes live with a window that includes a full host-side pread.

Verification (guest, 2026-09-30)

Static + dynamic:

• Dynamic attempt: 4-vCPU vkernel (-n 4; the default boots 2), PID1 forked 4 children hammering /dev/vcd0 with 20,000 mixed 64 KB reads/writes each (offsets 2048-aligned; the first attempt with 64-byte alignment was bounced by dscheck with ~2000 "not on a sector boundary" messages — those bios never reached the driver, so the test was fixed). Result: no crash, clean exit (RACE SURVIVED, run.log / run.2.log) — consistent with the mplock shield, not with a racy driver.
• Shield trace: kern_device.c:119-121 + 384-388 (above); vcd.c:67 has no D_MPSAFE. The vkernel is fully SMP (-n N, MAXCPU; cpu0..cpu3 observed in run logs).

Not reproduced because it cannot currently happen; filed as a latent hardening defect in the same spirit as DF-5010 (Info).

Recommended fix

When touching vcd (e.g. for DF-5171), either adopt vdisk's cothread structure or, minimally, wrap the bioq manipulation + drain in a crit_enter()/crit_exit() (single-CPU-per-thread) or a spinlock — and only then consider D_MPSAFE. Not validated in this run (no live bug to observe); the validated diff in this batch is DF-5171's.

DF-5172 VERDICT — vcd unlocked bio_queue: not reproduced — provably shielded by the mplock today; latent

Reproduced? NO — and the verification explains why that is the expected

result, not a failure of the PoC.

1. The defect is real in the driver: vcdstrategy() (vcd.c:148-149) does bioqdisksort() / bioq_takefirst() on sc->bio_queue with no lock of any kind, then runs a blocking pread/pwrite inside the drain loop (vcd.c:156-163) — the queue stays "open" for the duration of host I/O. vdisk's 2016 cothread rework exists exactly because this shape is unsafe (all vkd queue ops are under cothread_lock, vdisk.c:228-231/250-255/279-298).

2. The shield: vcd_ops lacks D_MPSAFE (vcd.c:67), so dev_dstrategy() wraps every call in the global mplock (kern_device.c:119-121, 384-388). Concurrent entries into vcdstrategy are impossible on any SMP configuration. Same class of incidental external guard as DF-5010's dscheck shield.

3. Dynamic attempt (honest): 4-vCPU vkernel (-n 4), 4 children × 20,000 × 64 KB mixed reads/writes on /dev/vcd0, 2048-aligned (first attempt was 64-aligned and was bounced wholesale by dscheck — 2000× "not on a sector boundary (ssize 2048)", bios never reached the driver; fixed and rerun). Result: RACE SURVIVED - no crash this run, clean init exit (run.log, run.2.log). Zero crashes — consistent with the mplock serialization.

4. Side observation: the first race attempt used -s 2 believing -s set ncpus; -s is actually RB_SINGLE (init.c:308-310) and "2" became a positional arg, breaking disk attach (mountroot panic). The ncpus flag is -n; the default vkernel already boots 2 vCPUs.

Verdict

not_reproduced / impact none (as observed) / the finding stands as a latent hazard: Info — if vcd is ever marked D_MPSAFE without adding driver-internal serialization, concurrent strategy calls corrupt the bio TAILQ (window includes a full host pread/pwrite). Recommended fix: adopt vkd's cothread (or minimally crit/lock the bioq) before any D_MPSAFE conversion. No fix.diff in this pack (nothing observable to validate against); DF-5171's validated diff touches the same function.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)