DF-5377 — mapped CTIO bounce pbuf leaked forever by targdone()'s

not-enabled free path (and targdtor): vm.pbuf_mem_count drain →

system-wide raw-I/O wedge

What

sys/bus/cam/scsi/scsi_target.c

• targsendccb() maps daemon CTIO data buffers via cam_periph_mapmem() (:788), which takes a bounce pbuf with getpbuf_mem() (cam_periph.c:643-767) and records it in descr->mapinfo (released only by cam_periph_unmapmem).
• The correct release is in targreturnccb() (:973-974) — but targdone()'s "no longer enabled, throw away CCB" path (:828-832) and targdtor()'s user_ccb_queue drain (:541-548) both call targfreeccb() directly, dropping mapinfo->bp[0] on the floor.
• A pbuf is never returned to the pool: vm.pbuf_mem_count (guest: 394) drops by one per leaked CTIO. Once drained, every getpbuf_mem() caller — raw physio I/O (dd if=/dev/daX), disk-label/GPT probes — blocks forever in tsleep(..., "wswbuf5") (vm/vm_pager.c:505-528).

Choreography (no race, no close; DF-1045 not involved)

per cycle on ONE fd: TARGIOCENABLE → write() CTIO (CAM_DIR_IN, dxfer 512) → targsim holds it → TARGIOCDISABLE (targsim fails the XPT_ABORT with CAM_UA_ABORT so the CTIO survives; EN_LUN disable succeeds → LUN_ENABLED cleared) → sysctl hw.targsim.complete=1 (rig xpt_done()s the held CTIO) → targdone() sees state not enabled → targfreeccb() → pbuf leaked. Repeat (re-enable works on the same softc).

Reproduce (guest, root)

cd /root/targpwn
make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
cc -O0 -g -o poc5377 poc5377.c
kldload ./targsim.ko; sleep 2
sysctl vm.pbuf_mem_count          # baseline (394 on this guest)
./poc5377 8                       # expect count -8 exactly
./poc5377 386 drain               # drain pool, then dd hangs forever

Expected

vm.pbuf_mem_count decreases by exactly the cycle count and never recovers; in drain mode dd if=/dev/da1 stays in the process table stuck on wswbuf5.

Files

• poc5377.c — leak loop + drain mode
• build.sh / run.sh
• build.log / run.log / run.drain.log
• fix.diff — cam_periph_unmapmem() before targfreeccb() in targdone() and targdtor

Fix-validation mode

./poc5377 8 x readback — on a kernel carrying fix.diff, the late CTIO completions are delivered via user_ccb_queue (not discarded in SWI context) and targdtor() releases the mapping in the daemon's context: the pool returns to baseline (394) and stays there. Note the fix went through three designs — v1 (unmapmem in targdone) and v2 (relpbuf in targdone) were REFUTED live (copyout is illegal in SWI context; the pbuf is BUF_LOCKed by the mapping thread) — see run.patched.log; the validated v3 routes the release into daemon context per the API contract in scsi_targetio.h.

DF-5377 VERDICT

Status: REPRODUCED (permanent pbuf leak → system-wide raw-I/O DoS),

fix validated (after two live-refuted intermediate fix designs)

Root cause

targsendccb() maps the daemon's CTIO data buffer through cam_periph_mapmem() (scsi_target.c:788; cam_periph.c:643-767), which allocates a bounce pbuf with getpbuf_mem() and records it in descr->mapinfo. The only release site is targreturnccb() (scsi_target.c:973-974). Two teardown paths free CCBs without releasing the mapping:

• targdone() not-enabled path (scsi_target.c:828-832): targfreeccb(softc, done_ccb) — drops mapinfo->bp[0];
• targdtor() user_ccb_queue drain (scsi_target.c:541-544): same.

Each dropped pbuf is never returned to the pool (vm.pbuf_mem_count, 394 on this guest); once the pool is empty every getpbuf_mem() caller sleeps forever in tsleep(..., "wswbuf5") (vm/vm_pager.c:505-528) — raw physio I/O (dd/fdisk/label ops on any disk) wedges system-wide until reboot.

Guest evidence (baseline kernel #0, targsim rig)

Choreography per cycle on one fd (no race, no close → DF-1045 not involved): TARGIOCENABLE → write() CTIO (CAM_DIR_IN, dxfer 512) → targsim holds it → TARGIOCDISABLE (rig fails the XPT_ABORT with CAM_UA_ABORT so the CTIO survives; EN_LUN disable clears LUN_ENABLED) → sysctl hw.targsim.complete=1 → rig xpt_done()s the held CTIO → targdone sees not-enabled → targfreeccb without unmap.

• run.log: vm.pbuf_mem_count: 394 → 386 after exactly 8 cycles, never recovers; hw.targsim.held_total: 8.
• run.drain.log: 386 further cycles → pbuf_mem_count=0; dd if=/dev/vbd0 of=/dev/null bs=64k count=1 then sits unkillable in D0 on wchan wswbuf5 — permanent system-wide raw-I/O wedge.

Fix engineering (documented honestly)

• v1 (cam_periph_unmapmem() inside targdone): REFUTED live — targdone runs in the cambio SWI where copyout() is illegal: Fatal trap 12 at copyout+0x14 (current process Idle).
• v2 (relpbuf-only inside targdone): REFUTED live — the pbuf is BUF_LOCK()ed by the mapping thread: panic: lockmgr: pid -1, not exclusive lock holder at relpbuf ← targdone ← camisr_runqueue.
• v3 (validated): route not-enabled completions to user_ccb_queue (per the documented API contract in scsi_targetio.h) and cam_periph_unmapmem() in targdtor() (daemon thread context, where copyout and the pbuf unlock are legal).

Fix validation (kernel #3, Sat Oct 3 18:32:37 2026)

./poc5377 8 x readback on the patched kernel: at most one pbuf outstanding during the run (393 at the measurement point), pool back to 394 baseline with zero permanent loss; guest healthy. [+] FIXED: pool fully restored after daemon read the completions. versus baseline −1-per-cycle-forever and the 394→0 drain wedge.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.