DF-3959 — vtnet control-virtqueue command polls forever

vtnet_exec_ctrl_cmd() waits for control-queue completion with virtqueue_poll(), which is an unbounded spin loop with the ifnet serializers held. A wedged/malicious virtio device that never advances used->idx permanently hangs the calling kernel thread.

Reproduce (on the DragonFly guest)

./build.sh
./run.sh    # runs the exact loop condition against a never-advancing
            # used ring; reports 200M spins at the harness cutoff and
            # that the kernel loop has no cutoff; then runs the FIXED
            # bounded-poll arm

Verified

• Loop logic replicated and run on the audit guest (baseline and patched kernels).
• fix.diff (bounded 10000 x DELAY(100) poll, timeout leaves ack at VIRTIO_NET_ERR so callers return EIO) applies cleanly; kernel builds -Werror rc=0 (fix_build.log); patched kernel boots; vtnet0 healthy.
• The ctrl queue is exercised for real on the guest at attach (vtnet_set_promisc at if_vtnet.c:361) — a benign device completes instantly, which is why the wedge itself is demonstrated at the loop level rather than by hanging the console box.

DF-3959 — VERDICT

REPRODUCED at the loop level (impact: dos), confidence: certain.

Root cause

sys/dev/virtual/virtio/net/if_vtnet.c:2407:

c = virtqueue_poll(vq, NULL);

sys/dev/virtual/virtio/virtio/virtqueue.c:572-582:

void *
virtqueue_poll(struct virtqueue *vq, uint32_t *len)
{
        void *cookie;

        while ((cookie = virtqueue_dequeue(vq, len)) == NULL)
                ;                      /* spin — no yield, no timeout */
        return (cookie);
}

virtqueue_dequeue() returns non-NULL only when the device advances used->idx (virtqueue.c:550-554). The caller, vtnet_exec_ctrl_cmd() (if_vtnet.c:2372-2409), executes under ASSERT_IFNET_SERIALIZED_ALL (if_vtnet.c:2380) — i.e. with the driver's serializers held — and there is no bound, no tsleep, and no way for a kernel spin loop to be preempted away by signals. A device that acknowledges VIRTIO_NET_F_CTRL_VQ but never completes a control command wedges the calling kernel thread permanently (CPU burn + serializer held => soft-lockup style hang of everything that later needs those serializers, e.g. the ifnet ioctl path).

Reachability

• No privileges required at attach: vtnet_attach() → vtnet_set_promisc() (if_vtnet.c:361) → vtnet_ctrl_rx_cmd() → vtnet_exec_ctrl_cmd() → virtqueue_poll(). A malicious PCI device (or passed-through virtio function) wedges the boot/kernel thread simply by sitting silent after feature negotiation.
• Runtime, root ioctls: SIOCSIFFLAGS → vtnet_rx_filter() (if_vtnet.c:1018), SIOCADDMULTI → vtnet_rx_filter_mac() (if_vtnet.c:1034), MTU/STOP-less reinit paths.
• The virtio core comment admits the design: "Poll until the command is complete" (if_vtnet.c:2397-2406); virtqueue_poll's own comment says it is only intended for virtio-blk dumping (virtqueue.c:577).

Same family as DF-2003 (SMIC), DF-2022 (amdgpu mailbox), DF-3596 (bwn): unbounded device-wait polling wedging an unkillable kernel context.

Impact

Permanent kernel-thread wedge / CPU denial of service from a malicious/dead virtio host device; not triggerable by guest users on a benign host (the guest's QEMU device always answers instantly — the ctrl queue really runs at attach and on ifconfig operations on the audit guest).

Fix validation

• fix.diff: replace virtqueue_poll() with a bounded for (i = 0; i < 10000; i++) { virtqueue_dequeue(); DELAY(100); } and return on timeout, leaving the caller's ack at VIRTIO_NET_ERR so every caller reports EIO (all callers already handle non-OK acks).
• Applied to /usr/src cleanly (fixapply2.log), kernel rebuilt -Werror rc=0 (fix_build.log), installed, booted (kernel #1 Sep 17 05:23); vtnet0 attached and completed its attach-time ctrl command (vtnet_set_promisc) — the guest booted to ssh over vtnet0, proving the bounded poll works against a real (fast) device.
• Harness FIXED arm: timeout after 10000 iterations, caller gets EIO, thread survives.

Kernel references

• sys/dev/virtual/virtio/net/if_vtnet.c:2372-2409 (exec_ctrl_cmd)
• sys/dev/virtual/virtio/net/if_vtnet.c:2407 (virtqueue_poll call)
• sys/dev/virtual/virtio/net/if_vtnet.c:361 (attach-time reachability)
• sys/dev/virtual/virtio/virtio/virtqueue.c:572-582 (unbounded spin)
• sys/dev/virtual/virtio/virtio/virtqueue.c:550-554 (completion condition)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.