DF-3596 — Unbounded device-register polling loops under BWN_LOCK (bwn_intr_pmq, bwn_core_start): permanent lock-held wedge on stalled device

Build / Run / Expected

# on the DF guest, as root:
sh probe.sh

Guest result: driver resident, no Broadcom hardware → runtime inconclusive. On a BCM43xx machine with a wedged/failing card (or malicious card that simply stops updating the PS_STATUS / XMITSTAT registers): the next PMQ interrupt or core-start spins forever reading the frozen register while holding sc_lk exclusive — the bwn taskq thread pegs a CPU, every subsequent ioctl/start/stop on the interface blocks forever in lockmgr (unkillable), and the device can no longer be reset or detached. System-wide soft hang of the wlan subsystem.

VERDICT — DF-3596

Status: inconclusive at runtime (no bwn hardware on the audit guest); defect source-certain. Impact: DoS — unkillable lock-held kernel spin (wlan subsystem wedge) on stalled device.

Root cause (path:line)

Two while (1) loops poll device registers with no iteration bound and no timeout, both executing with BWN_LOCK held (sc_lk, lockmgr exclusive — if_bwnvar.h:1030-1035):

1. bwn_intr_pmq() — sys/dev/netif/bwn/bwn/if_bwn.c:5168-5178: c while (1) { tmp = BWN_READ_4(mac, BWN_PS_STATUS); if (!(tmp & 0x00000008)) break; } Called from bwn_intrtask (:4995-4996) on every BWN_INTR_PMQ (part of BWN_INTR_MASKTEMPLATE, if_bwnreg.h:326), i.e. straight from the device's power-management-queue interrupt, under the lock taken at :4954.
2. bwn_core_start() — if_bwn.c:2234-2239: c while (1) { tmp = BWN_READ_4(mac, BWN_XMITSTAT_0); if (!(tmp & 0x00000001)) break; tmp = BWN_READ_4(mac, BWN_XMITSTAT_1); } Reached from bwn_init/bwn_hwreset/bwn_switch_band with the lock held.

Every other polling loop in this driver is bounded (bwn_dma_tx_reset 10 iterations :3307, bwn_mac_suspend 35+40 :3836-3847, bwn_psctl 100 :3898, PIO rxeof 10 :5567, ucode-timeout loop 21 :4263) — these two are the outliers, and the upstream Linux b43 equivalent (b43_pio_tx / ssb-wait helpers) uses bounded waits.

Impact when a card stalls (failing hardware is the classic trigger; a malicious mini-PCIe card can freeze the register deliberately): the loop never exits; the bwn taskq thread spins at 100% holding sc_lk forever. Every later ifconfig bwn0 …, TX wakeup (bwn_start), detach, or suspend blocks unkillably on the lock; the watchdog callout (sc_watchdog_ch shares sc_lk, if_bwn.c:844) also blocks, so even the device-timeout printer dies. Not a panic — a permanent, unkillable subsystem wedge.

Why runtime reproduction was not possible

Same as the sibling findings: the audit guest has no Broadcom 802.11 device (run.log); the loop bodies are unreachable. A qemu-specific device model would be required to emulate a stalling bwn card.

Fix

Bound both loops with a retry budget and bail out with a device_printf on timeout — see fix.diff.

Artifacts

• probe.sh, run.log — guest probe (driver residency + hardware absence)
• fix.diff — proposed patch vs read-only sys/ tree (never applied)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.