DF-4305 — bfe_intr error reinit performs M_WAITOK cluster allocations in interrupt context

File: sys/dev/netif/bfe/if_bfe.c (pass 2; known DF-1509 not touched) Lines: 1176-1187 (bfe_intr ISTAT_ERRORS → bfe_init), 1186, 1362-1386 (bfe_init), 1368 (bfe_list_rx_init), 538-554 (bfe_list_rx_init → bfe_newbuf(sc, i, 1)), 565 (m = m_getcl(init ? M_WAITOK : M_NOWAIT, ...)), 576 (if_printf in the load-fail path).

The bug

On any DMA/RX/TX error interrupt (BFE_ISTAT_ERRORS: DSCE/DATAE/DPE/RDU/ RFO/TFU), bfe_intr clears IFF_RUNNING and calls bfe_init from interrupt context (if_bfe.c:1186). bfe_init → bfe_list_rx_init (:1368) → bfe_newbuf(sc, i, 1) with init=1 → m_getcl(M_WAITOK) (:565) for 511 clusters, plus bus_dmamap_load_mbuf_segment (BUS_DMA_NOWAIT, safe) and — on load failure — if_printf (:576).

M_WAITOK may block indefinitely in the mbuf allocator when the cluster zone is exhausted — in an interrupt thread holding the interface serializer. The realistic trigger is self-reinforcing: RDU ("receive descriptor underflow") fires precisely when the system is out of buffers (the driver failed to refill the ring), i.e. exactly when the M_WAITOK re-arm is most likely to sleep. A sleeping ithread stops servicing its IRQ line; with the serializer held, every other entry point on the interface blocks too; if the allocation depends on network progress to free clusters, the wait can persist indefinitely (soft deadlock), otherwise it stalls the interrupt pipeline for the allocation latency.

The TX-watchdog reinit path (bfe_watchdog :1470-1483 → bfe_init :1480) runs in netisr context — equally non-sleepable — and hits the same M_WAITOK.

Severity Low: requires the error interrupt (hardware/error conditions, typically under system-wide memory exhaustion); impact is a stalled interface/interrupt line rather than memory corruption.

Guest status

No BCM4401 hardware exists on this guest (env.txt: NO_BROADCOM_PCI, hw.bfe unknown oid; QEMU has no device model), so the path cannot be executed — not_reproduced per family convention (cf. DF-3827). The defect is certain from source.

Build/run (nothing runnable without hardware)

See env.txt for the presence probes; fix.diff is the waitok plumbing.

Fix

Plumb a waitok flag: interrupt/watchdog reinit paths call bfe_init_waitok(sc, 0) → bfe_newbuf uses M_NOWAIT (see fix.diff, patch -p1 --dry-run clean).

DF-4305 VERDICT — sleepable allocation in bfe's interrupt-context reinit

Bottom line

Source-certain defect; runtime not reproducible on this guest (no BCM4401; QEMU cannot emulate one — env.txt). Recorded not_reproduced per family convention (DF-3827). Impact ceiling on real hardware: interrupt-thread stall / soft interface deadlock under cluster exhaustion — availability only, Low severity, no corruption, no leak.

Trace

1. bfe_intr (:1152-1200) processes istat & BFE_ISTAT_ERRORS (if_bfereg.h:40-41) → bfe_init(sc) at :1186 — this is the hardware interrupt handler (registered via bus_setup_intr :418-420, serializer passed).
2. bfe_init (:1355-1387) → bfe_list_rx_init(sc) :1368.
3. bfe_list_rx_init (:538-554) loops bfe_newbuf(sc, i, 1) — init=1.
4. bfe_newbuf (:557-595): m = m_getcl(init ? M_WAITOK : M_NOWAIT, MT_DATA, M_PKTHDR) :565 — M_WAITOK in ithread context.
5. On bus_dmamap_load_mbuf_segment failure: if_printf :576 (console output from interrupt context — tolerated but noisy).

Sibling path: bfe_watchdog :1470-1483 → bfe_init :1480 runs from if_slowtimo_dispatch (netisr, sys/net/if.c:1900-1912) — also non-sleepable.

Why it matters (threat)

BFE_ISTAT_RDU (receive descriptor underflow) is raised when the driver runs out of posted RX buffers — i.e. under cluster shortage. The recovery path then demands 511 new clusters with M_WAITOK from the ithread. Under the same shortage the allocator sleeps; the ithread (holding the serializer, pinning its IRQ) sleeps with it. Until clusters free up (possible only if other CPUs/network progress releases them) the NIC and its interrupt line are dead; if nothing frees clusters (all freeing paths blocked behind the same serializer), the stall is permanent. Realistic but narrow: Low severity.

Negative results (adjacent, this file)

• bfe_init from bfe_ioctl (SIOCSIFFLAGS :1448) is process context — M_WAITOK fine there.
• bfe_list_rx_init error path (== ENOBUFS :1368-1373) stops and calls bfe_stop — clean.
• The map-swap in bfe_newbuf (:583-588) is correct on both load-success and retained-mbuf paths.

Fix validation

fix.diff plumbs waitok (intr/watchdog pass 0 → M_NOWAIT; process paths keep M_WAITOK), patch -p1 --dry-run clean. Cannot be runtime-validated without hardware → fix_status not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.