DF-5636 VERDICT — REPRODUCED

Finding: smbus_request_bus() (sys/bus/smbus/smbconf.c:111-144) returns success without acquiring ownership on two paths, because the ownership loop never re-checks sc->owner after smbus_poll() and converts poll's EWOULDBLOCK into success.

Root cause (path:line)

1. Wake path phantom grant — smbconf.c:126-141. When the waiter is woken (smbus_poll returns 0 from tsleep), the loop executes if (error == 0) break; (smbconf.c:137-138) and returns 0 without re-entering the ownership check and without ever setting sc->owner = dev (only the else-branch at :134 sets it). Compare the iiconf.c twin loop (iiconf.c:99-114), which loops back and re-checks. Every contended request that is woken produces a caller that "holds" a bus nobody recorded: the next requester sees owner == NULL (or another device) and is granted too — two concurrent granted holders of the SMBus.

2. DONTWAIT phantom grant — smbconf.c:131-132. smbus_poll() returns EWOULDBLOCK for SMB_DONTWAIT (default case, smbconf.c:96-98); the if (error == EWOULDBLOCK) error = 0; fixup erases the only failure signal of the fast-fail path, and the same break returns 0 while sc->owner still belongs to another device.

The unconditional wakeup(sc) at smbconf.c:177 (fired on every release, including the EACCES non-owner path) multiplies the trigger surface: any release anywhere on the bus wakes parked requesters into the phantom-grant path (proved by F3B: a grant while sc->owner verifiably still belonged to another device, with no release at all having occurred).

Reproduction (rig, production modules, stock kernel)

Chain: fakebb0 → iicbb0 → iicbus0 → iicsmb0 → smbus0 (all real; smbus is compiled into the guest's X86_64_GENERIC — config line 335 — so the code under test was the in-kernel production copy; wire sanity round-trip passed before every test).

• F1 (run.log): devA owns; devB parks; devA releases → T(devB): request RETURNED 0 with sc->owner=0 (caller=devB) <<< PHANTOM GRANT; devC then granted immediately → double grant (summary=0x3).
• F2: request(devB, SMB_DONTWAIT)=0 while owner was still another device — <<< PHANTOM GRANT (must be EWOULDBLOCK) (summary=0x1).
• F3B: parked devB woken by a non-owner's EACCES release → error=0 owner_seen=devA <<< GRANTED while another device verifiably OWNS the bus (no release ever happened) (summary=0x1).

Impact

Mutual exclusion is the smbus core's single responsibility: the transfer methods of the bridge (iicsmb.c:276-507 quick/sendb/recvb/writeb/writew/ readb/readw/pcall/bwrite/bread) perform no arbitration of their own — they rely entirely on the caller holding the bus. A phantom grant therefore puts two kernel threads inside one SMBus transaction concurrently: interleaved I2C wire transactions on iicbb/ig4-class controllers, and on ichsmb the documented single-transaction state machine trips its KASSERT(sc->ich_cmd == -1) (panic — the DF-5459 class, there caused by a driver no-op, here by the core itself). In-tree contending children exist on ordinary hardware (ipmi_ssif vs /dev/smb on server boards; cyapa's poll thread vs anything else on laptops). Triggering requires two bus users and either a wakeup (routine) or SMB_DONTWAIT (/dev/smb nonblocking ioctls, cyapa/atmel O_NONBLOCK opens — all root-only devices, or kernel threads), hence Medium severity / local DoS + silent SMBus transaction corruption (e.g. interleaved IPMI SSIF responses) rather than an unprivileged path.

No memory corruption is involved (the protocol hands out grants, not bytes), so there is no uid=0 chain; the ceiling is mutual-exclusion bypass with the consequences above.

Fix validation (same guest, kernel rebuilt)

fix.diff (smbconf.c): re-check ownership after every poll return; treat a WAIT poll timeout as a retry, never as success; keep DONTWAIT failures; error = 0 only when ownership is claimed; plus the DF-5637/5638 legs (release validates ownership before the bridge release, no EACCES wakeup, PCATCH + hz-bounded park). Applied to /usr/src, quickkernel rebuilt (smbconf.o recompiled), installed, rebooted (kernel #3):

• F1 → summary=0x0: F1.3w ... owner=<devB> (the woken waiter claimed), devC parked until released, final owner=0 (clean=NULL).
• F2 → request(devB, SMB_DONTWAIT)=35 (EWOULDBLOCK: correctly refused).
• F3B → devB still parked (no bogus wakeup: GOOD on fixed code).
• Park → S2 smbreq, kill -9 kills it.

Two intermediate fix iterations were required (first version leaked a stale EWOULDBLOCK through the claim path, second returned EWOULDBLOCK after one timeout instead of retrying); the final fix.diff in this pack is the validated one. The residual limitations (crit-section MP-unsafety is addressed separately as DF-5637; no detach drain — parking is now bounded and killable, which defuses the DF-5563-class unload UAF for this file) are noted in the pack README.

Classification

status=reproduced, reproduced=1, impact=dos, confidence=certain.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.