⬢ DragonFlyBSD Kernel Audit
DF-3778 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "finding_id": "DF-3778",
  "file": "sys/dev/netif/jme/if_jme.c",
  "verdict": "inconclusive",
  "impact_class": "none",
  "reproduce": {
    "build": "n/a (analysis-only trigger.c; fix compile-validated via incremental nativekernel build, fix_build.log)",
    "run": "vm.sh run_root 'ifconfig -l; pciconf -l | grep -i -E \"jmicron|JMC\" || echo NO_JMICRON_PCI; kldstat -v | grep -E \"jme/miibus|pci/if_jme\"; grep -n \"jme_rxeof(rdata\" /usr/src/sys/dev/netif/jme/if_jme.c; grep -cn process_limit /usr/src/sys/dev/netif/jme/if_jme.c'",
    "expected": "Source-level certain: jme_rxeof (sys/dev/netif/jme/if_jme.c:2494-2562) has one work bound (count, :2496) and every interrupt-context call site passes -1 (jme_rx_intr :3500, jme_msix_rx :3845, jme_rx_restart :3882) while the driver's own ifpoll path passes a real bound (:3341, cycle) and no bound knob exists (process_limit: 0 hits). Per-iteration work (m_getcl + dmamap load + if_input, :3061-3082/:2474) exceeds the 672ns 64-byte 1GbE line-rate inter-arrival budget, so a remote unauthenticated line-rate small-packet flood keeps the ring perpetually non-empty and the interrupt handler spins forever holding its serializer (ring serializer under MSI-X; MAIN serializer under legacy/MSI - wedging the whole interface including ifconfig-down recovery). Runtime hardware-gated: guest has no JMicron NIC (presence probe in run.log; if_jme compiled into the running kernel) -> inconclusive per family convention (DF-3761/alc precedent)."
  },
  "kernel_refs": [
    "sys/dev/netif/jme/if_jme.c:2494",
    "sys/dev/netif/jme/if_jme.c:2496",
    "sys/dev/netif/jme/if_jme.c:3341",
    "sys/dev/netif/jme/if_jme.c:3500",
    "sys/dev/netif/jme/if_jme.c:3845",
    "sys/dev/netif/jme/if_jme.c:3882",
    "sys/dev/netif/jme/if_jme.c:2150",
    "sys/dev/netif/jme/if_jme.c:3912",
    "sys/dev/netif/jme/if_jme.c:3672",
    "sys/dev/netif/jme/if_jme.c:3061"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "run.log",
    "fix_build.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}