DF-5565 — IIC_DONTWAIT + busy bridge callback = unkillable tight kernel loop (livelock)

• File under audit: sys/bus/iicbus/iiconf.c (pass 2)
• Class: local DoS (CPU livelock, unkillable)
• Severity: Low (root-gated; in-tree reachable via lpbb/ppbus contention)
• Verdict: REPRODUCED (non-destructive), fix validated

The bug

The first loop of iicbus_request_bus() (iiconf.c:92-97):

do {
        error = IICBUS_CALLBACK(device_get_parent(bus),
                        IIC_REQUEST_BUS, (caddr_t)&how);
        if (error)
                error = iicbus_poll(sc, how);
} while (error == EWOULDBLOCK);

With how == IIC_DONTWAIT (0), iicbus_poll() takes the default: case and returns EWOULDBLOCK immediately without sleeping (iiconf.c:70-72). If the bridge callback persistently reports busy, the loop retries forever: no sleep, no yield, no signal checkpoint — a tight kernel-mode loop that burns one CPU and cannot be interrupted by SIGKILL.

In-tree reachability: lpbb is the bridge whose callback can report busy — lpbb_callback (sys/dev/misc/lpbb/lpbb.c:90-113) forwards to ppb_request_bus, which returns EWOULDBLOCK immediately for PPB_DONTWAIT when another ppbus client (e.g. lpt printing, or another lpbb user) holds the parallel port (sys/bus/ppbus/ppbconf.c:458-493). DONTWAIT callers: iicwrite/iicread on /dev/iicN (sys/bus/iicbus/iic.c:212-213, 253-254). Requires lpbb-class hardware (parallel-port I2C) or any KLD bridge with the same contract — the rig's hw.df5563.busy=1 emulates it faithfully.

Contrast: the second loop (owner contention) handles the DONTWAIT EWOULDBLOCK correctly (releases and returns, iiconf.c:110-113); only the first loop spins.

Reproduce (non-destructive)

sysctl hw.df5563.busy=1
./park nowait &          # enters the loop; never returns
ps -o pid,stat,time -p $!   # STAT R+ (running, never sleeps), TIME += wall clock
kill -9 $!               # IGNORED
sysctl hw.df5563.busy=0  # next callback succeeds -> loop exits, process dies with pending SIGKILL

Expected output (baseline)

--- ps t0 ---                --- ps t1 (+3s) ---
  2007 R1       0:03.01       2007 R1       0:06.01   <-- 100% kernel CPU
SIGKILL_IGNORED=YES
GONE_AFTER_UNBUSY=YES

CPU time accrues 1:1 with wall clock (3 s CPU per 3 s wall) while the thread is in kernel mode the whole time.

Fix

Covered by DF-5563's fix.diff: the restructured loop does exactly one callback attempt for DONTWAIT — iicbus_poll()'s EWOULDBLOCK exits the loop instead of retrying. Validation (fix_run.log): with the patched iicbus.ko, ./park nowait under busy returns errno=35 (EWOULDBLOCK) immediately, twice, with no spin; the sanity round trip still passes.