⬢ DragonFlyBSD Kernel Audit
DF-3904 / sk_rxeof_walk_shape.c
← back to finding ↓ download raw
/*
 * DF-3904 analysis aid: sk_rxeof walk-bound probe.
 *
 * NOT runnable without SysKonnect hardware - kept as the source-level
 * demonstration of the missing work bound. This stub documents the loop
 * shape that the finding is about:
 *
 *   sk_rxeof (if_sk.c:1820-1888)
 *     for (;;) {                          <-- NO iteration bound
 *         sk_ctl = cur_desc->sk_ctl;
 *         if (sk_ctl & SK_RXCTL_OWN) {    <-- only exit: NIC owns next desc
 *             cd->sk_rx_prod = cur;
 *             break;
 *         }
 *         ...
 *         sk_newbuf(sc_if, cur, 0);       <-- reposts OWN to the NIC
 *         ifp->if_input(ifp, m, NULL, -1);
 *     }
 *
 * A line-rate remote flood keeps freshly-reposted descriptors completing
 * ahead of the walker: after a full lap of the 256-deep ring the loop
 * revisits descriptor 0 which the NIC has by then re-completed, so the
 * loop never observes OWN and never exits - all under the card-global
 * sc->sk_serializer held by sk_intr (bus_setup_intr ..., &sc->sk_serializer
 * if_sk.c:1514), starving the softclock/netisr/other-port work on that
 * CPU (RX livelock; DF-3761 family).
 *
 * The sibling driver msk(4) bounds the identical walk via
 * sc->msk_process_limit (if_msk.c:3225, tunable mskc.process_limit);
 * FreeBSD's sk(4) bounded it in r~251845 era via RX polling budget.
 */
int df3904_source_probe_unused;