DF-5563 — iicbus_request_bus parks threads on the softc with no timeout and no detach drain → freed-text execution (UAF) on module teardown

• File under audit: sys/bus/iicbus/iiconf.c (pass 2)
• Class: kernel use-after-free / execution of unloaded module text (memcorrupt)
• Severity: Low (root-gated trigger: /dev/iicN 0600 + kldunload; in-tree kthread victims: ipmi_ssif / cyapa racing an admin unload)
• Verdict: REPRODUCED (kernel panic, both entry variants), fix validated

What the code does

iicbus_request_bus() (sys/bus/iicbus/iiconf.c:85-117) parks requesting threads inside iicbus_poll() (iiconf.c:56-76):

case IIC_WAIT | IIC_INTR:
        error = tsleep(sc, PCATCH, "iicreq", 0);   /* iiconf.c:63 */
case IIC_WAIT | IIC_NOINTR:
        error = tsleep(sc, 0, "iicreq", 0);        /* iiconf.c:67 */

Three properties combine into a use-after-free:

1. timeout 0 — the sleep is unbounded;
2. the sleep channel IS the iicbus softc (sc), and nothing in the detach path (iicbus_detach, sys/bus/iicbus/iicbus.c:156-162) wakes or drains sleepers before device_delete_child() frees the softc;
3. the parked thread's return PC is inside iicbus.ko module text (iiconf.c compiles into iicbus.ko, sys/bus/iicbus/iicbus/Makefile), which kldunload unmaps (devclass_delete_driver() force-detaches, sys/kern/subr_bus.c:853-899; module text freed at unload — same mechanism DF-5521 proved for iicsmb).

So: park a requester (any blocking /dev/iic0 ioctl — iic.c:297-300 — or the smbus passthrough of SMB_WAIT), then kldunload the i2c stack, then deliver the pending signal (or any colliding wakeup(sc) after the softc memory is reused). The thread resumes at an address inside the unmapped iicbus.ko text → page fault in kernel mode → panic. A colliding-wakeup variant additionally re-enters the request loops with a freed sc: sc->owner read (iiconf.c:101), sc->owner = dev write (iiconf.c:105), and IICBUS_CALLBACK(device_get_parent(bus)) dispatch through the freed device — a UAF write primitive into reclaimed memory.

Distinct from DF-5521: that finding (and its fix) quiesced the transaction holder side (iicsmb_detach returning EBUSY while the bridge owns the iicbus). A waiter — blocked because someone else owns the bus, or because the bridge callback reports busy — never owns anything, is invisible to that fix, and is exactly what this PoC parks.

Rig

Fake GPIO bridge (df5563_rig.c, evolution of the DF-5539/5558 fakebb rig): nexus → fakebb0 → iicbb0 (real iicbb.ko) → iicbus0 (real iicbus.ko, code under test) → iic0 (real iic.ko, /dev/iic0).

hw.df5563.busy=1 makes fakebb_callback(IIC_REQUEST_BUS) return EWOULDBLOCK — the exact contract lpbb gives when the ppbus is held by another client (sys/dev/misc/lpbb/lpbb.c:97-101 → ppb_request_bus → EWOULDBLOCK, sys/bus/ppbus/ppbconf.c:458-493). /dev/df5563 ioctls call iicbus_request_bus()/iicbus_release_bus() directly with each how.

/dev/iic0 requires the disclosed setup fixes DF-5559 (ivar accessor) + DF-5560 (sc->sc_dev) applied to the guest /usr/src — same as the DF-5558 evidence pack.

Reproduce

# on the guest as root, after staging /root/df5563, /root/df5559, /root/df5560
sh build.sh                       # rig KLDs + park
cd /usr/src
patch -p1 --fuzz=2 < /root/df5559/fix.diff
patch -p1 --fuzz=2 < /root/df5560/fix.diff
( cd sys/bus/iicbus/iicbus && make ) ; ( cd sys/bus/iicbus/iic && make )
sh /root/df5563/run_f1.sh         # variant B (rig device)  -> panic
# after reset + restage:
sh /root/df5563/run_f1a.sh        # variant A (/dev/iic0)   -> panic

run_f1a.sh = variant A (in-tree entry): ./park iic issues a blocking I2CSTART on /dev/iic0 → iicioctl → iicbus_request_bus(IIC_WAIT|IIC_INTR) → parked at iicreq; then kldunload iic df5563_rig iicbb_reg iicbb iicbus (all rc=0); then kill -9.

Expected output (baseline, both variants)

   PID STAT   WCHAN    COMMAND
  1480 S0     iicreq   ./park iic          <- parked, timeout 0
rc(iic)=0 ... rc(iicbus)=0                  <- all five modules unloaded under it
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xffffffff826001ab   <- iicbus.ko+0x1ab (kldstat: 0xffffffff82600000+0x1000)
instruction pointer    = 0x8:0xffffffff826001ab
current process        = 1480                 <- the parked requester

panic.txt (variant B) and panic_variant_a.txt (variant A) hold the serial-console captures; run_f1_variantB.log / run_f1_variantA.log hold the driving-session output (kldstat before unload).

Fix

fix.diff (3 files: iiconf.c, iicbus.c, iicbus.h): * iicbus_poll(): always PCATCH, always bounded (hz); timeout treated as spurious wakeup so the IIC_WAIT contract is preserved; * iicbus_request_bus(): restructured loops — DONTWAIT does one attempt (also fixes DF-5565), dying checks after every sleep, waiters count under a new softc spinlock; * iicbus_detach(): sets dying, wakes sleepers, drains waiters to 0 before the softc/text go away.

Fix validation (run_fixed_validation.log): with the patched iicbus.ko, the identical F1 sequence parks the requester, all five modules still unload (rc=0 — detach now drains), no panic, guest healthy, and the parker's ioctl returns ENXIO (errno 6) via the dying path. The attach round trip (SANITY: write_ok=1 read_ok=1) passes on the patched module.

Threat model

Root on both sides (0600 device + kldunload). The kthread variant (ipmi_ssif/cyapa parked on SMB_WAIT passthrough racing an admin kldunload) needs no /dev node — an administrator unloading i2c modules on a busy BMC server hits it with the same panic. Rated Low, bucket memcorrupt, family-consistent with DF-5521.

DF-5563 VERDICT — REPRODUCED (kernel UAF: parked thread resumes into unloaded iicbus.ko text); fix validated

The bug (path:line)

iicbus_request_bus() (sys/bus/iicbus/iiconf.c:85-117) parks requesters in iicbus_poll():

• iiconf.c:63 tsleep(sc, PCATCH, "iicreq", 0) — unbounded, channel = softc
• iiconf.c:67 tsleep(sc, 0, "iicreq", 0) — unbounded, no PCATCH (see DF-5564)

Nothing protects that sleep against teardown:

• iicbus_detach() (sys/bus/iicbus/iicbus.c:156-162) only resets the bus and detaches children — it neither wakes nor drains request sleepers;
• devclass_delete_driver() (sys/kern/subr_bus.c:853-899) force-calls detach for every device of the driver when its module unloads, then the linker frees the module text — while the parked thread's saved RIP is inside that text (iiconf.c compiles into iicbus.ko, sys/bus/iicbus/iicbus/Makefile);
• kldunload does not count sleeping threads as module references.

Consequences (both demonstrated or line-traced):

1. Freed-text execution (demonstrated, both variants): signal the parked PCATCH sleeper after unloading iicbus.ko → it resumes at an unmapped address → Fatal trap 12, supervisor read instruction, page not present.
2. Freed-softc channel + UAF write (line-traced): after the bridge module unload frees the iicbus softc under the sleeper, any colliding wakeup(sc) (the freed address reused as another object's sleep channel) wakes it with error==0 → the do-while re-calls IICBUS_CALLBACK(device_get_parent(bus)) on the freed device (iiconf.c:93) and the owner loop performs sc->owner = dev (iiconf.c:105) — an 8-byte write of a device_t into reclaimed memory, plus sc->owner reads at iiconf.c:101.

Distinction from the known family findings

• DF-5521 fixed the holder side (iicsmb_detach quiesce + iicbus_bus_owned()). A waiter never owns the bus, so that fix does not cover this path — verified by reading the DF-5521 fix and by this PoC parking a pure waiter (the bridge callback reports busy; ownership is never granted).
• DF-5490 (pcf NULL softc in iicbus_intr) and the DF-5521 note about iicbus_intr dispatching through a driverless kobj (iiconf.c:50-51) are about the interrupt path, not the request/sleep path.

Reproduction (guest, stock iiconf.c; both variants)

Rig: df5563_rig.c — fake GPIO bridge under nexus; production chain fakebb0 → iicbb0 (iicbb.ko) → iicbus0 (iicbus.ko) → iic0 (iic.ko, /dev/iic0). hw.df5563.busy=1 → fakebb_callback returns EWOULDBLOCK (lpbb/ppbus-held contract). /dev/df5563 ioctls drive iicbus_request_bus with each how.

• Variant B (rig device): ./park intr → parked S2 iicreq; kldunload iic df5563_rig iicbb_reg iicbb iicbus (all rc=0); kill -9 → Fatal trap 12, RIP 0xffffffff826001ab = unloaded iicbus.ko+0x1ab (kldstat before unload: iicbus.ko at 0xffffffff82600000, size 0x1000), current process = the parked pid (2031). See panic.txt, run_f1_variantB.log.
• Variant A (in-tree entry): ./park iic → blocking I2CSTART on /dev/iic0 → iicioctl (iic.c:297-300) → parked S0 iicreq; same unload chain (rc=0 ×5); kill -9 → identical trap at 0xffffffff826001ab, current process 1480. See panic_variant_a.txt, run_f1_variantA.log.

The fault address is deterministic across variants and runs: it is the instruction after tsleep's return path inside iicbus_poll.

Threat model

Root-gated on the trigger side (0600 /dev/iicN, kldunload), same band as DF-5521. Kthread victims (ipmi_ssif at sys/dev/misc/ipmi/ipmi_ssif.c:81,181, cyapa at sys/dev/smbus/cyapa/cyapa.c:1176,1624 pass SMB_WAIT through smbus_request_bus → iicsmb_callback → iicbus_request_bus(parent, dev, IIC_WAIT)) park at iiconf.c:67 with no PCATCH: an administrator unloading i2c modules on a busy BMC server cannot even signal them.

Fix (validated)

fix.diff: bounded+PCATCH polling with timeout-as-spurious-wakeup; restructured request loops (single DONTWAIT attempt — also DF-5565; dying checks; spinlock-protected owner/dying/waiters); iicbus_detach wakes and drains waiters before teardown.

Validation (run_fixed_validation.log, guest, patched iicbus.ko): F1 sequence re-run — parker confirmed parked (S1 iicreq), all five modules still unload rc=0 (detach now blocks until the waiter drains), no panic, guest healthy (uptime), and the parker's ioctl returned ENXIO (errno 6) via the dying path. Attach round trip SANITY: write_ok=1 read_ok=1 passes on the patched module, and the whole chain reloads cleanly afterwards.

patch -R -p1 --dry-run of the shipped fix.diff against the validated tree succeeds — the diff is byte-equivalent to what was tested.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.