DF-3761 — alc_rxintr() has no work bound; process_limit knob is dead

Severity: Medium (remote-triggerable NIC/CPU livelock on default config) — DragonFly sys/dev/netif/alc/if_alc.c, pass 2 (GLM 5.3).

What

alc_rxintr() (sys/dev/netif/alc/if_alc.c:3222-3289) processes Rx return ring entries in an unbounded loop:

for (prog = 0; (ifp->if_flags & IFF_RUNNING) != 0;) {
    rrd = &sc->alc_rdata.alc_rr_ring[rr_cons];
    status = le32toh(rrd->status);
    if ((status & RRD_VALID) == 0)
        break;
    ...
    alc_rxeof(sc, rrd); /* fresh cluster + dmamap load per buffer */
}

The driver exposes exactly the knob meant to bound this — hw.alcN.process_limit (alc_sysctl_node, if_alc.c:1696-1713, ALC_PROC_DEFAULT 64, if_alcvar.h:71-73) — but nothing in the driver ever consults it; grep on the guest shows the only references are the sysctl setup (run.log). It is a dead knob.

FreeBSD bounds the identical loop (alc_rxintr(sc, int count): if (count-- <= 0) break;), and DragonFly's sibling driver msk(4) bounds its Rx walk the same way (if_msk.c:3225).

Impact

Under a sustained line-rate flood (1.488 Mpps of 64-byte frames at 1 GbE — remote, unauthenticated, default config):

• per frame the loop performs an m_getcl cluster allocation + bus_dmamap_load_mbuf_segment + RRS processing + if_input enqueue — provably slower than line-rate arrival, so the return ring stays perpetually non-empty and the loop never terminates;
• alc_intr disabled the NIC interrupt at entry (if_alc.c:3082) and only re-enables it after the loop (if_alc.c:3110) — there is no exit and no moderation;
• the whole loop runs in the interrupt thread holding the interface serializer → one CPU pinned at 100% forever, every other driver entry point (ifconfig, ioctls, tick) blocks indefinitely, and callouts starve on that CPU.

Fix: bound the loop with the existing knob (fix.diff, ports FreeBSD's count-- <= 0 idiom; alc_intr's re-enable at :3110 makes the device immediately re-raise the RX interrupt if work remains, so no packets are lost).

Reproduce

Trigger needs AR81xx hardware + a packet generator (documented in trigger.c). The audit guest has no Atheros device (env.txt/run.log: NO_ATHEROS_PCI, ifconfig -l = vtnet0 lo0, no hw.alc sysctl), so runtime verification is honestly inconclusive per family convention; source-level certainty is established by the guest-side greps in run.log (knob referenced only at :1697-1711 = setup; loop at :3236 has no bound) and the FreeBSD/msk comparison.

DF-3761 — VERDICT

Status: source-level certain (loop provably unbounded, knob provably dead); runtime honestly inconclusive — the trigger is a remote line-rate flood against AR81xx hardware the audit guest does not have. reproduced=0, impact=none-on-this-guest; class ceiling on real hardware: remote-triggerable NIC + single-CPU livelock (DoS) on default config.

Root cause (path:line)

1. sys/dev/netif/alc/if_alc.c:3236 — for (prog = 0; (ifp->if_flags & IFF_RUNNING) != 0;): the Rx return ring walk has no work bound; it exits only when an entry lacks RRD_VALID (:3239-3240) or the interface stopped running.
2. sys/dev/netif/alc/if_alc.c:1696-1713 — the driver creates and clamps hw.alcN.process_limit (ALC_PROC_MIN 16 / ALC_PROC_MAX 255 / ALC_PROC_DEFAULT 64, sys/dev/netif/alc/if_alcvar.h:71-73) — and then never reads it anywhere (guest-side grep, run.log: references only at :1697-1711). Dead knob.
3. sys/dev/netif/alc/if_alc.c:3082 / :3110 — alc_intr disables the NIC interrupt on entry (INTR_DIS_INT) and re-enables it only after alc_rxintr returns; combined with (1) an unterminating walk means the handler never re-arms interrupt delivery and never yields.
4. Per-iteration cost: alc_rxeof (:3248) → alc_newbuf (:3332, m_getcl + bus_dmamap_load_mbuf_segment per Rx buffer, :3187-3199) + if_input enqueue — μs-scale, i.e. slower than 1.488 Mpps line-rate arrival, so under a sustained flood the return ring is perpetually non-empty and the loop never exits.

Divergence proof: FreeBSD bounds the identical loop — sys/dev/alc/if_alc.c (head) alc_rxintr(struct alc_softc *sc, int count) with if (count-- <= 0) break; at the loop head; DragonFly's sibling msk(4) likewise (sys/dev/netif/msk/if_msk.c:3225, if (rxprog > sc->msk_process_limit)). The knob's presence in the DFly alc driver without a reader is strong evidence the bound was intended and lost.

Impact analysis

Remote, unauthenticated, default configuration (only needs the NIC to be up): flood the interface at line rate →

• the NIC's interrupt thread spins in alc_rxintr forever, pinning one CPU at 100%;
• it holds the interface serializer for the whole walk (alc_intr asserts the serializer, :3075), so every other driver entry point — ifconfig, any ioctl on the interface, alc_tick — blocks indefinitely;
• kernel threads at lower priority than the (realtime-ish) interrupt thread on that CPU starve, including callout/softclock delivery.

Interface recovery requires the flood to stop; the interface is unusable for any other traffic in the meantime (RX monopolizes the ring). Not a memory-safety bug; a service-availability bug of exactly the class process_limit exists to prevent.

Verification performed (guest, DragonFly 6.5-DEVELOPMENT x86_64)

• Presence probe (run.log, env.txt): NO_ATHEROS_PCI, ifconfig -l = vtnet0 lo0, NO_ALC_KLD, sysctl hw.alc → unknown oid, /boot/kernel/if_alc.ko present only as a module file → the alc instance cannot be exercised at runtime; honestly inconclusive per family convention.
• Source-level proof on the guest itself (run.log): grep -n 'alc_process_limit' /usr/src/sys/dev/netif/alc/if_alc.c → only :1697-1711 (sysctl setup); the loop at :3236 has no reference to it.
• Guest /usr/src if_alc.c byte-identical to audited tree (md5 fb1a46ef2b2559de4aa5d508e03efcd5, env.txt).
• FreeBSD head comparison fetched and quoted in README/finding (alc_rxintr(sc, count), if (count-- <= 0) break;).

Fix

fix.diff (git-apply clean): port FreeBSD's idiom — take n = sc->alc_process_limit before the loop and if (n-- <= 0) break; at the loop head. When the bound trips, alc_intr's trailing CSR_WRITE_4(sc, ALC_INTR_STATUS, 0x7FFFFFFF) (:3110) re-enables interrupts and the still-non-empty ring immediately re-raises the RX interrupt, so no packets are lost — the bound only restores scheduler fairness (and finally makes the admin-visible knob functional).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.