Summary

The probe loop calls smbus_trans directly, unlike every other issuer: on re-attach the probes can interleave with a live client's owned transaction (memory-safe via controller serializers but protocol-level interleaving wedges slow slaves and yields garbage probes mid-transfer); a quiet controller stalls the attaching thread ~96 per-transaction timeouts; SMB_TRANS_NOREPORT masks controller faults as no-device. request-bus-wrapped-probing fix.

PoC verification

Evidence pack

findings/poc/DF-5645 · 2 files

File	Type	Description	Size
README.md	file		1.7 KB	↓ raw
verdict.json	file		2.0 KB	view raw

README.md file

↓ download raw

DF-5645 — smbus_attach's probe loop issues bus transactions without owning the bus (arbitration bypass)

File: sys/bus/smbus/smbus.c (pass 2) — Severity: Info — untested (Phase V skipped per Low/Info rule)

The defect

smbus_probe_device (smbus.c:122-140) calls smbus_trans(dev, ...) directly (smbus.c:131) — never smbus_request_bus. Every other in-tree issuer of transactions arbitrates first: smbioctl (smb.c:240-243), cyapa (via its own request paths), ipmi_ssif. The probe loop therefore bypasses the sc->owner exclusion (smbus.h:34, smbconf.c:126-141) entirely:

on re-attach (DF-5642's cycle) the 96 probe transactions can interleave with a live client's owned transaction on the same controller — the controller-level serializer keeps this memory-safe, but SMBus protocol-level interleaving can wedge slow slaves and produces garbage probe results mid-transfer;
each probe is a bounded-timeout real transaction: 96 addresses × controller timeout (e.g. ~35 ms) ≈ 3.4 s of attach-time stall on a quiet controller, in the attaching thread;
SMB_TRANS_NOREPORT (smbus.c:132) suppresses the error reporting, so a wedged controller looks like "no devices" instead of a fault.

No memory-safety violation: the transaction buffer is u_char buf[2] with rcount = 1 (smbus.c:127-133) — in bounds; controller drivers clamp counts. Filed as Info (protocol hygiene + attach stall).

Fix direction

Wrap the probe loop in smbus_request_bus(dev, dev, SMB_DONTWAIT) / smbus_release_bus (skip probing if the bus is owned — a re-attach should not bounce the wire under a live client).

verdict: verdict.json (status: untested).

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not validated (Info-level; skipped per contract)

n/a

per-fix-DF-5645

Detail

Evidence (decisive lines)

README.md (path:line chain); contrast with smb.c:240-243 arbitration

PoC changes

n/a (not built)

Verified recommended fix

Arbitrate before probing: request the bus SMB_DONTWAIT around the smbus_attach probe loop and skip probes when it is owned.

Verdict

Source-proven protocol defect, not runtime-verified (Phase V skipped per Low/Info rule). smbus_probe_device (smbus.c:122-140) issues smbus_trans at smbus.c:131 without smbus_request_bus -- the only in-tree transaction issuer that bypasses the sc->owner arbitration (smbus.h:34, smbconf.c:126-141; compare smb.c:240-243). On re-attach (the DF-5642 cycle) the 96 probe transactions can interleave with a live client's owned transaction on the same controller (memory-safe thanks to controller serializers, but protocol-level interleaving can wedge slow slaves and produces garbage probe results); each probe is a bounded-timeout real transaction so a quiet/wedged controller stalls the attaching thread ~96 x controller-timeout; SMB_TRANS_NOREPORT (smbus.c:132) hides controller faults as 'no device'. Buffer is in-bounds (u_char buf[2], rcount=1, smbus.c:127-133): no memory-safety violation.

smbus_attach's probe loop issues 96 real bus transactions without smbus_request_bus — the only transaction issuer in the tree that bypasses the sc->owner arbitration, interleaving with owned transfers on re-attach and stalling attach by ~96 controller timeouts