DF-1126 — Infinite loop in isp_intr response-queue processing (SCSI target mode)

Finding

isp_intr at sys/dev/disk/isp/isp.c:5121-5124:

while (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}

The loop body assigns to optr but never modifies tsto or oop — the condition is invariant. isp_handle_other_response (:5113) passes &tsto to isp_target_notify (isp_target.c:5988), which in the long-IU continuation path (isp_target.c:178-181) advances *optrp (= tsto). After return, tsto != oop and the loop spins forever in hard interrupt context → permanent kernel hang.

Requires ISP_TARGET_MODE compiled (not default) and a target-mode FC adapter receiving an Extended CDB/IU > 56 bytes from a remote initiator.

Reachability on this guest

NOT reachable. No QLogic ISP FC adapter present. ISP_TARGET_MODE is not compiled into the default modules. Doubly gated. Latent.

A userspace harness demonstrates the invariant loop (capped at 1M iters to prove non-termination rather than actually hang).

Build / Run / Expected

cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "LOOP DID NOT ADVANCE tsto -- infinite loop confirmed"

Files

• harness.c — simulates the queue bookkeeping; proves the loop body never advances tsto.
• fix.diff — changes while (tsto != oop) to if (tsto != oop).
• build.log / run.log / env.txt — captured outputs.

VERDICT — DF-1126

Verdict: REPRODUCED (primitive) / NOT REACHABLE on guest (HW-gated)

The cited bug is real and confirmed by source trace + userspace loop-bookkeeping demonstration. It is a latent infinite-loop / hang primitive requiring ISP_TARGET_MODE compiled (not default) and a target-mode FC adapter receiving an Extended CDB/IU.

Mechanism (confirmed path:line)

1. isp_intr (sys/dev/disk/isp/isp.c:5112-5124) processes response queue entries. For unrecognized entry types it calls isp_handle_other_response(isp, etype, hp, &tsto) (:5113) where tsto is a local initialized to oop.
2. isp_handle_other_response (:5964-6022) for RQSTYPE_ATIO etc. calls isp_target_notify(isp, hp, optrp) (:5988) inside #ifdef ISP_TARGET_MODE.
3. isp_target_notify (sys/dev/disk/isp/isp_target.c:104) for an RQSTYPE_ATIO7 (IS_24XX) with a long IU (at_ta_len > QENTRY_LEN-8) advances *optrp in a loop at :178-181: *optrp = ISP_NXT_QENTRY(*optrp, RESULT_QUEUE_LEN(isp)).
4. Back in isp_intr:5121-5124: c while (tsto != oop) { optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp)); } The body assigns to optr but never modifies tsto or oop. After isp_target_notify advanced tsto past oop, the condition is invariantly true → infinite spin in hard interrupt context → permanent kernel hang.

Reproduction (userspace harness)

The harness simulates the queue pointers, calls a stand-in for isp_handle_other_response that advances tsto by one slot, then runs the exact kernel loop body (capped at 1M iterations to prove non-termination rather than actually hang):

oop  = 100
tsto = 101  (advanced by isp_target_notify long-IU path)
Hit iteration cap (1000000) without termination.
tsto before loop = 101, tsto after = 101 (UNCHANGED)
*** LOOP DID NOT ADVANCE tsto -- infinite loop confirmed ***

Impact ceiling

• Per-trigger: permanent kernel hang in hard interrupt context. The CPU spinning in isp_intr cannot be preempted; the system is wedged.
• Privilege: remote — a FC initiator sending an Extended CDB/IU > 56 bytes triggers it. Requires target-mode FC adapter with ISP_TARGET_MODE.
• Realistic: doubly gated (ISP_TARGET_MODE not default + FC target role). Niche but remote-triggerable when configured.

Fix

fix.diff changes while to if:

if (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}

The body was always meant to run at most once (it only computes the next optr from the updated tsto). The while was a latent bug because the body never advances the loop variables.

Validated: isp.ko builds with RC=0 after applying the fix.

Fix validation

• Patch applies cleanly: Hunk #1 succeeded at 5114.
• make in sys/dev/disk/isp/ → isp.ko + all FC firmware modules linked, ISP_RC=0.
• Cannot boot-test (no QLogic ISP FC adapter + no ISP_TARGET_MODE); fix_status: not_testable.

PoC changes

• harness.c written from scratch. Simulates queue pointers and proves the loop body never advances tsto (capped at 1M iters).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.