DF-3428 — generic_netmap_rxsync reserved wrap → infinite kernel loop

Build / Run

• ./build.sh — module build attempt (fails on this tree; shared netmap_build.log).
• ./run.sh — trigger sketch only; module absent.

The math (certain from source)

ring->reserved and ring->avail are mmap'd userspace-writable u_int32 (sys/net/netmap/netmap.h:221-223). With lim = nkr_num_slots - 1 = 1023:

• resvd = 0xFFFFFFFF, avail = 1 → resvd + ring->avail == 0 (mod 2^32) → validation at netmap_generic.c:694 (>= lim + 1) passes.
• k = cur ≤ lim < resvd → else-branch: k = cur + 1024 + 1 - 0xFFFFFFFF ≡ cur + 1026 (mod 2^32) → k ∈ [1026, 2049], always > lim.
• Release loop for (n = 0; j != k; n++) (:702) — j only ever takes values in [0, lim] → never terminates.

Locking: generic_netmap_rxsync runs under the kring busy/lock protocol (netmap.c:1474 ioctl path / netmap.c:1768 poll path, nm_kr_get → q_lock), so the looping thread is unkillable and every other user of the ring blocks: unkillable local DoS. Slot writes stay in-bounds (livelock, not corruption).

Precondition

/dev/netmap open (created 0660 root:wheel, netmap.c:2237) — same gate as DF-0616/DF-3426. Severity Medium: local DoS behind a privileged device.

Verdict

build_failed — module unbuildable on this tree (identical blocker as DF-3426/3427); arithmetic verified by hand and by contrast with the non-looping host-ring variant (netmap.c:886-930).

DF-3428 VERDICT — rxsync reserved-overflow livelock

status: build_failed | reproduced: 0 | impact: none (not exercisable) | finding severity: Medium (local DoS, source-certain)

Reproduced?

No — netmap KLD unbuildable on this tree (see netmap_build.log). The arithmetic, however, is fully determined:

resvd = ring->reserved   // user-writable u_int32 (netmap.h:223, mmap'd)
resvd = 0xFFFFFFFF, ring->avail = 1
resvd + ring->avail      // netmap_generic.c:694, 32-bit: == 0
0 >= lim + 1 (1024)?     // NO -> check passes, resvd NOT reset
k = ring->cur = 0        // validated <= lim at :643
k < resvd  ->  k = k + lim + 1 - resvd   // :698, mod 2^32
          =  0 + 1024 + 1 - 4294967295
          =  1026  (> lim = 1023)
for (n = 0; j != k; n++) // :702; j ∈ [0..1023] forever, k = 1026

Every slot write in the loop is in-bounds (slot[j], j wraps at lim) — this is a pure livelock of the calling thread while it holds the kring (nm_kr_get/q_lock via netmap.c:1474 NIOCRXSYNC or :1768 poll), wedging the ring and pinning the CPU at 100% in-kernel; the thread cannot be killed (never sleeps).

Why the wrap check fails

:694 if (resvd + ring->avail >= lim + 1) performs the sum in 32-bit u_int; two attacker-chosen large values wrap to a small one and bypass the "invalid reserve" reset. The subtraction at :698 then underflows k out of the [0, lim] range the loop can never reach.

Sibling check: netmap_rxsync_from_host (netmap.c:886-930) has the same 32-bit wrap but computes only deltas (n = k >= j ? k-j : k+lim-j) — no loop, so only userspace-visible accounting is corrupted there. The infinite loop is unique to generic_netmap_rxsync (netmap_generic.c:700-711).

Fix

Validate resvd against lim before use (it can never legitimately exceed the slot count); see fix.diff. not_testable (module unbuildable).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.