DF-3807 — mskc_handle_events() infinite drain on a status LE naming an unattached port

Verdict

Mechanism PROVEN on the guest kernel by a deterministic replica of if_msk.c's exact mskc_handle_events()/mskc_intr() drain loop over a synthetic 2048-entry status ring; msk-specific runtime hardware-gated (the port bit is written by the NIC's status unit — needs faulty/hostile Yukon hardware or errant DMA). Severity Medium, confidence certain.

Root cause (path:line)

mskc_handle_events() (sys/dev/netif/msk/if_msk.c:3137-3238) walks the DMA'd status ring from sc->msk_stat_cons to the device-supplied STAT_PUT_IDX:

3153:   for (cons = sc->msk_stat_cons; cons != idx;) {
3155:       control = le32toh(sd->msk_control);
3156:       if ((control & HW_OWNER) == 0)
3157:           break;
3165:       control &= ~HW_OWNER;
3166:       sd->msk_control = htole32(control);   /* LE released */
3169:       port = (control >> 16) & 0x01;
3170:       sc_if = sc->msk_if[port];
3171:       if (sc_if == NULL) {
3172:           device_printf(sc->msk_dev, "invalid port opcode "
3173:               "0x%08x\n", control & STLE_OP_MASK);
3174:           continue;                         /* <-- BUG */
3175:       }
...
3224:       MSK_INC(cons, MSK_STAT_RING_CNT);      /* ONLY advance */

The continue at :3174 skips the loop's only consumer-index advance (MSK_INC at :3224). For a status LE whose port bit names a port with no interface attached — msk_if[1] == NULL on every single-port adapter (only attached ports are registered, if_msk.c:1383, children created at :1699-1719; a failed port attach also NULLs the slot, :1469) — the first pass releases the LE (HW_OWNER cleared) and continues with cons unchanged; the second pass re-reads the same LE, sees HW_OWNER clear and breaks. msk_stat_cons never advances while STAT_PUT_IDX is past it, so mskc_handle_events() (:3237 return (cons != STAT_PUT_IDX)) returns non-zero forever, and mskc_intr()'s outer drain

3291:   while (mskc_handle_events(sc) != 0)
3292:       ;

spins permanently — with sc->msk_serializer held (the IRQ is muxed through it, if_msk.c:1729-1731) and before the interrupt is re-enabled (B0_Y2_SP_ICR write at :3297): hard system hang, both ports of the controller wedged, the interrupt never completes. The driver itself believes this input is possible — it prints "invalid port opcode" — but the handling hangs the box instead of skipping the LE.

Note the process-limit bound (rxprog > sc->msk_process_limit, :3225) also sits after the skipped increment, so it never guards this path either; and even without the NULL-port bug, the outer while re-enters mskc_handle_events after a process-limit break, making the limit a per-chunk rather than a per-interrupt bound (drain-to-empty design shared with upstream FreeBSD — noted, not filed).

Guest proof (deterministic replica, exact loop shape)

msk_hevent_replica.ko (fake msk_stat_desc ring of MSK_STAT_RING_CNT=2048 entries, STAT_PUT_IDX=5, LE0 = HW_OWNER | port 1 where msk_if[1] == NULL, LE1..4 ordinary):

• fix-shape control (MSK_INC in the NULL-port branch = fix.diff): mskrep2[fixed]: drain returned 0 after 0 outer iterations, stat_cons=5 idx=5 rx_frames=4 — interrupt re-enabled (B0_Y2_SP_ICR), ISR RETURNS
• shipped shape: SPINNING outer=67108864 … outer=88046829568 stat_cons=0 idx=5 (no progress) — 88 billion drain iterations, consumer index stuck at 0, ~670M iterations/s, zero progress; the guest became unusable to ssh from the kernel-priority spin (no panic — pure permanent spin/starvation). Killed only via the module's documented instrumentation escape; the real driver has none.

Files: run.log (session transcript incl. the fixed-shape control), serial_console.txt (decisive console sequence + spin-marker count + no-panic check), build.log, msk_hevent_replica.c, fix.diff, env.txt.

Fix

fix.diff: advance the consumer past the offending LE before continue (MSK_INC(cons, MSK_STAT_RING_CNT) in the NULL-port branch). Mechanism validated live (fixed-shape control returns, consumer advances, ISR completes). Driver-level validation needs Yukon hardware → fix_status=not_testable.

Kernel references

sys/dev/netif/msk/if_msk.c:1699-1719 (children only for attached ports), :1383, :1469, :1729-1731 (IRQ muxed through serializer), :3137-3238 (:3153, :3156-3157, :3165-3166, :3169-3174, :3224, :3225, :3229, :3237), :3291-3297.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.