DF-1126 — Infinite loop in isp_intr response-queue processing (SCSI target mode)

Finding

isp_intr at sys/dev/disk/isp/isp.c:5121-5124:

while (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}

The loop body assigns to optr but never modifies tsto or oop — the condition is invariant. isp_handle_other_response (:5113) passes &tsto to isp_target_notify (isp_target.c:5988), which in the long-IU continuation path (isp_target.c:178-181) advances *optrp (= tsto). After return, tsto != oop and the loop spins forever in hard interrupt context → permanent kernel hang.

Requires ISP_TARGET_MODE compiled (not default) and a target-mode FC adapter receiving an Extended CDB/IU > 56 bytes from a remote initiator.

Reachability on this guest

NOT reachable. No QLogic ISP FC adapter present. ISP_TARGET_MODE is not compiled into the default modules. Doubly gated. Latent.

A userspace harness demonstrates the invariant loop (capped at 1M iters to prove non-termination rather than actually hang).

Build / Run / Expected

cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "LOOP DID NOT ADVANCE tsto -- infinite loop confirmed"

Files

• harness.c — simulates the queue bookkeeping; proves the loop body never advances tsto.
• fix.diff — changes while (tsto != oop) to if (tsto != oop).
• build.log / run.log / env.txt — captured outputs.

VERDICT — DF-1126

Verdict: REPRODUCED (primitive) / NOT REACHABLE on guest (HW-gated)

The cited bug is real and confirmed by source trace + userspace loop-bookkeeping demonstration. It is a latent infinite-loop / hang primitive requiring ISP_TARGET_MODE compiled (not default) and a target-mode FC adapter receiving an Extended CDB/IU.

Mechanism (confirmed path:line)

1. isp_intr (sys/dev/disk/isp/isp.c:5112-5124) processes response queue entries. For unrecognized entry types it calls isp_handle_other_response(isp, etype, hp, &tsto) (:5113) where tsto is a local initialized to oop.
2. isp_handle_other_response (:5964-6022) for RQSTYPE_ATIO etc. calls isp_target_notify(isp, hp, optrp) (:5988) inside #ifdef ISP_TARGET_MODE.
3. isp_target_notify (sys/dev/disk/isp/isp_target.c:104) for an RQSTYPE_ATIO7 (IS_24XX) with a long IU (at_ta_len > QENTRY_LEN-8) advances *optrp in a loop at :178-181: *optrp = ISP_NXT_QENTRY(*optrp, RESULT_QUEUE_LEN(isp)).
4. Back in isp_intr:5121-5124: c while (tsto != oop) { optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp)); } The body assigns to optr but never modifies tsto or oop. After isp_target_notify advanced tsto past oop, the condition is invariantly true → infinite spin in hard interrupt context → permanent kernel hang.

Reproduction (userspace harness)

The harness simulates the queue pointers, calls a stand-in for isp_handle_other_response that advances tsto by one slot, then runs the exact kernel loop body (capped at 1M iterations to prove non-termination rather than actually hang):

oop  = 100
tsto = 101  (advanced by isp_target_notify long-IU path)
Hit iteration cap (1000000) without termination.
tsto before loop = 101, tsto after = 101 (UNCHANGED)
*** LOOP DID NOT ADVANCE tsto -- infinite loop confirmed ***

Impact ceiling

• Per-trigger: permanent kernel hang in hard interrupt context. The CPU spinning in isp_intr cannot be preempted; the system is wedged.
• Privilege: remote — a FC initiator sending an Extended CDB/IU > 56 bytes triggers it. Requires target-mode FC adapter with ISP_TARGET_MODE.
• Realistic: doubly gated (ISP_TARGET_MODE not default + FC target role). Niche but remote-triggerable when configured.

Fix

fix.diff changes while to if:

if (tsto != oop) {
    optr = ISP_NXT_QENTRY(tsto, RESULT_QUEUE_LEN(isp));
}

The body was always meant to run at most once (it only computes the next optr from the updated tsto). The while was a latent bug because the body never advances the loop variables.

Validated: isp.ko builds with RC=0 after applying the fix.

Fix validation

• Patch applies cleanly: Hunk #1 succeeded at 5114.
• make in sys/dev/disk/isp/ → isp.ko + all FC firmware modules linked, ISP_RC=0.
• Cannot boot-test (no QLogic ISP FC adapter + no ISP_TARGET_MODE); fix_status: not_testable.

PoC changes

• harness.c written from scratch. Simulates queue pointers and proves the loop body never advances tsto (capped at 1M iters).