DF-3778 — jme_rxeof() RX walk has no work bound on the interrupt path: remote line-rate flood keeps the ring perpetually non-empty, handler spins holding the serializer (NIC + CPU livelock)

File: sys/dev/netif/jme/if_jme.c (pass 2) Class: DF-3761 (alc) family — independent jme(4) instance Severity: Medium · CWE: CWE-834 (Uncontrolled Recursion/Consumption) · Confidence: certain (source), runtime hardware-gated

What

jme_rxeof (:2488-2562) has exactly one work bound — the count parameter (:2496) — and every interrupt-context call site passes -1: jme_rx_intr :3500 (legacy/MSI jme_intr), jme_msix_rx :3845, jme_rx_restart :3882 (jme_msix_status/jme_npoll_status). Only the ifpoll path bounds it (:3341, cycle). Each iteration is µs-scale (jme_newbuf = m_getcl + bus_dmamap_load_mbuf_segment :3061-3074, plus if_input dispatch), while a 64-byte flood on 1GbE arrives every 672ns → under sustained small-packet line-rate the ring never drains and the handler never returns:

• MSI-X RX: the ring's serializer is held for the whole walk (:3837) — that CPU spins, all other ring entry points block;
• legacy/MSI: jme_intr takes the MAIN serializer (:3912 registration, :2118 assert) then walks every ring (:3499) — the whole interface wedges behind an unbounded walk, plus the interrupt thread pins its CPU.

No bound knob exists at all in the driver (process_limit: 0 hits, run.log) — the count parameter and the ifpoll call site prove the bound was intended and available. Sibling precedent: DF-3761 (alc, knob dead), DFly msk(4) bounds its own walk; FreeBSD bounds these loops.

Trigger

Remote, unauthenticated, default configuration: flood jme0 with minimum-size frames at line rate while the interface is up.

Reproduce

Hardware-gated on this guest (no JMicron NIC — see run.log presence probe; if_jme is compiled into the running kernel). Source-level argument is complete in trigger.c; per family convention (DF-3761) the verdict is inconclusive with impact none-on-this-guest.

Fix

fix.diff — hw.jme.rx_proc_limit (default 64, tunable) passed at the three interrupt-context call sites; safe because all three handlers mask their interrupt on entry and re-enable at exit, so a bounded early exit re-interrupts immediately. The :418 link-reconfig drain stays unbounded (interrupts masked, must fully drain). Compile-validated (fix_build.log: nativekernel RC=0, 0 warnings).

DF-3778 — VERDICT

Status: source-level certain (loop provably unbounded on the interrupt path; bound provably available and used elsewhere in the same function); runtime honestly inconclusive — the trigger is a remote line-rate flood against JMC250/JMC260 hardware the audit guest does not have. reproduced=0, impact=none-on-this-guest; class ceiling on real hardware: remote-triggerable NIC + single-CPU (legacy/MSI: whole-interface) livelock DoS on default config. DF-3761 (alc) family, independent if_jme.c instance.

Root cause (path:line)

1. sys/dev/netif/jme/if_jme.c:2494-2497 — the RX walk's only work bound is the count parameter: if (count >= 0 && count-- == 0) break;. With count == -1 the loop exits only when the ring drains (OWN set, :2500) or a consistency break fires (:2502/:2513/:2551).
2. Interrupt-context call sites all pass -1: * jme_rx_intr — sys/dev/netif/jme/if_jme.c:3500 (from jme_intr :2150; handler registered on the MAIN serializer sc->jme_serialize, :3912, asserted at :2118 — the whole interface is behind the walk; jme_intr masks all interrupts at :2125 and re-enables at :2174); * jme_msix_rx — :3845 (handler registered on the ring serializer, :3672; masks jme_rx_coal at :3839, unmasks at :3847); * jme_rx_restart — :3882 (from jme_msix_status :3866 / jme_npoll_status :3330; INTR_RXQ_DESC_EMPTY masked at entry).
3. Per-iteration cost: jme_rxpkt → jme_newbuf (m_getcl + bus_dmamap_load_mbuf_segment, :3061-3082) + if_input dispatch (:2474) — µs-scale, i.e. slower than 1.488 Mpps 64-byte line-rate arrival (672ns budget) on the 1GbE JMC250, so a sustained small-packet flood keeps the ring perpetually non-empty and the walk never terminates while the handler holds its serializer.
4. The bound is provably available and intended: the same function is called WITH a bound by the driver's own ifpoll path (jme_npoll_rx, :3341, passes cycle); DragonFly's msk(4) bounds its own walk; the alc(4) twin of this defect is filed as DF-3761; FreeBSD bounds these loops. jme has no bound knob at all (grep -c process_limit if_jme.c == 0, run.log).

Impact analysis (on hardware)

Remote, unauthenticated, default configuration (interface up): flood at line rate →

• MSI-X RX vector: that ring's jme_rx_serialize is held forever → the IRQ thread spins at 100% on its CPU; every other entry point on the ring (ioctls, npoll, RX restart) blocks indefinitely;
• legacy/MSI interrupt: sc->jme_serialize (main) held → the whole interface (including jme_stop/jme_init, i.e. recovery via ifconfig jme0 down) blocks — the livelock cannot be administratively cleared without a reboot on legacy/MSI configurations;
• lower-priority kernel threads on the pinned CPU starve.

Verification performed (guest, DragonFly 6.5-DEVELOPMENT x86_64)

run.log (2026-09-16): presence probe — no JMicron PCI device (vtnet0 lo0 only); driver compiled into the running kernel (kldstat -v: 102 jme/miibus, 103 pci/if_jme); guest-side grep of /usr/src — the five jme_rxeof(rdata, ...) call sites with their arguments (three × -1 interrupt-path, one × -1 drain-path, one × cycle bounded ifpoll) and zero process_limit references. Runtime reproduction requires a JMicron NIC under line-rate flood → hardware- gated, inconclusive per family convention (DF-3761 precedent).

Fix validation

• fix.diff (git-apply clean): introduces jme_rx_proc_limit (default 64, TUNABLE_INT("hw.jme.rx_proc_limit", ...)) and passes it at the three interrupt-context call sites (:3500/:3845/:3882).
• Safety argument: each of those handlers masks its interrupt on entry and re-enables it at exit (jme_msix_rx :3839/:3847, jme_intr :2125/:2174, jme_msix_status :3859/:3869), so a bounded early exit with work remaining raises a fresh interrupt immediately — no frame loss, only the unbounded spin is removed. The jme_miibus_statchg drain (:418) is deliberately left unbounded: it runs at link reconfiguration with all interrupts masked (:403) and must fully drain the ring before the indices are reset (:427).
• Compile-validated on the guest: all three jme fixes (DF-3776/3777/ 3778) applied together to /usr/src, incremental nativekernel X86_64_GENERIC build → RC=0, zero warnings (fix_build.log).
• Driver-level runtime validation impossible without JMicron hardware → fix_status: not_testable.

Bottom line

jme(4)'s interrupt-path RX walk is unbounded (count=-1 at all three interrupt call sites) in a driver whose ifpoll path proves the bound exists; a remote line-rate small-packet flood livelocks the handler holding the ring serializer (legacy/MSI: the main serializer — the whole interface, un-recoverable by ifconfig). The DF-3761/alc family defect, independently instantiated in if_jme.c; fix is a 64-frame budget knob at three call sites, compile-clean.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.