DF-2324 — PCI capability-list traversal lacks cycle detection — evidence pack

Finding: sys/bus/pci/pci.c:877-892 (pci_read_capabilities) and pci.c:1407-1414 (pci_find_extcap_method) loop on device-controlled capability next-pointers with no iteration bound (and extcap follows unaligned pointers without the pci_fixup_nextptr masking) — a malicious device with a cyclic cap list hangs kernel enumeration.

Verdict (short)

REPRODUCED on the stock INVARIANTS kernel: both walkers driven with a fabricated 0x40<->0x60 cycle NEVER returned; a 2 Hz hard-IRQ systimer watchdog fired at 12 s with marker panics (panic_cap_cycle.txt, panic_extcap_cycle.txt) — decisive hang proof. The unaligned-pointer follow (0x40->0x45->0x4A) also demonstrated (extcap, no masking). Legit linear chains enumerate identically pre/post fix (CAPDIGEST byte-identical). Fixed kernel: both cycles terminate (RETURNED / ENXIO).

Rig

Shared with DF-2323 (same kernel-compiled verbatim-interposition harness, same verbatim sha256 gates — see DF-2323/rig and env.txt). Trigger: sysctl debug.dfpcih.cmd="cap cycle|cap linear|extcap cycle|extcap linear|extcap odd".

Reproduce

See rig/run_2324.sh; fixed-kernel A/B in rig/fixed_runs.log (DFPCIPF = production config + rig/fix.diff).

Files

• VERDICT.md — narrative, tables, fix A/B
• panic_cap_cycle.txt, panic_extcap_cycle.txt — watchdog hang captures
• rig/linear_baseline.log — legit-chain digest (stock kernel)
• rig/fixed_runs.log — fixed-kernel runs (cycles RETURN, digest identical)
• rig/ — harness + generators + fix.diff (shared rig, identical copies)
• env.txt, manifest.json, verdict.json

DF-2324 — capability-list traversal has no cycle detection — VERDICT

status: reproduced / impact: panic (the mechanical capture of a kernel-hang / unbounded-enumeration-loop denial of service; the watchdog panic is the proof instrument, the observed behavior is that the walker never returns).

Line-accurate analysis (verified mechanically)

• pci_read_capabilities (pci.c:877-892) loops while (pci_fixup_nextptr(&nextptr)) where nextptr is read from DEVICE config space (REG(ptr + PCICAP_NEXTPTR, 1) at pci.c:882). pci_fixup_nextptr (pci.c:601-634) only masks the low 2 bits and rejects values < 0x40 — it does NOT detect re-visits. A device that points 0x40 -> 0x60 -> 0x40 makes this loop spin forever.
• pci_find_extcap_method (pci.c:1407-1414) loops while (ptr != 0) with ptr = pci_read_config(child, ptr + PCICAP_NEXTPTR, 1) — NO masking (unlike pci_fixup_nextptr), NO < 0x40 rejection, NO iteration bound. A self-loop or 2-cycle spins forever; unaligned pointers are followed verbatim.
• Both walkers run during device enumeration (boot for every PCI device; hotplug/rescan later) and in driver probe/attach paths — a malicious device hangs the kernel in a tight loop with the bus lock context of the enumeration path (boot hang / livelocked CPU).

What was run

Fabricated config space driven through the VERBATIM walkers (sha256-gated extracts; see DF-2323 pack rig, shared).

The watchdog (rig/dfpci_post.c dfh_watchdog, 2 Hz systimer, fires from hard-interrupt context at 12 s) is the decisive-hang instrument: a 48-entry max walk returns in microseconds; a non-returning walker after 12 s of spinning is a hang by construction, and the panic backtrace shows the systimer interrupt frames.

Impact

Malicious PCI device (AV:P / crafted passthrough) hangs the kernel in an unbounded loop at enumeration time: boot never completes (every boot), hotplug rescan wedges, driver probe paths livelock. No memory corruption; availability only. If triggered post-boot the looping thread spins with preemption points absent (tight C loop) — on this UP-ish guest the console went unresponsive immediately.

Fix (validated A/B)

rig/fix.diff (combined diff, DF-2324 hunks): - pci_read_capabilities: int ncap guard, if (++ncap > (0x100 - 0x40) / 4) break; — config space has at most 48 aligned capability slots above 0x40. - pci_find_extcap_method: sanitize ptr &= ~0x3 (same masking as pci_fixup_nextptr, closing the unaligned-pointer follow) and if (++ncap > 0x100 / 4) return (ENXIO);.

A/B: cycles now terminate (RETURNED), the linear-chain digest is byte-identical pre/post fix, extcap find results unchanged.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)