DF-5026 — ips: bios queued to an offline adapter are never completed (ips_disk.c)

File: sys/dev/raid/ips/ips_disk.c (pass 2, with the swallowed error in sys/dev/raid/ips/ips_commands.c:246-247) Lines: ips_disk.c:128-143 (strategy, no fail-fast), ips_commands.c:246-247 (error swallowed), ips.c:207-209/220 (EIO/EBUSY sources), ips.c:354-358 (IPS_OFFLINE set after failed reinit) Class: missing-completion DoS — the ips instance of the DF-5012/DF-2066 systemic pattern.

Build (guest, root)

sh build.sh

Run

sh run.sh          # original pattern: wedge + kill -9 + poke
sh run_ab.sh       # A/B: original vs fixed pattern

Expected output (decisive lines from run.log)

   PID STAT   WCHAN    COMMAND
  1275 D3     physstr  /tmp/poc/df5026_trigger wedge /dev/df50260
-- after SIGKILL, still present? --
  1275 D3     physstr  ...            <-- survives kill -9
df5026: poke -- draining 7 parked bio(s) with EIO
gone                                 <-- released only by external completion

And from run_fixed_ab.log (FIXED pattern):

wedge: pread@2097152 r=-1 errno=5(Input/output error)   <-- immediate EIO
no wedge process remains (fixed pattern)

Mechanism

ips_timeout() (ips.c:354-358) declares the adapter IPS_OFFLINE after a failed forced reinit ("AIEE! adapter reset failed"). From then on ips_get_free_cmd() returns EIO (ips.c:207-209) — but ips_start_io_request() discards the error code entirely (ips_commands.c:246-247) and returns, leaving the bio on sc->bio_queue forever; ipsd_strategy() (ips_disk.c:134-141) keeps accepting and enqueuing new bios with no fail-fast. No biodone() ever fires: every issuer (including fs-flush on close) parks in uninterruptible biowait, and bio_queue grows without bound. The unload-time observation in run.log ("draining 6 parked bio(s)" AFTER the poke drained 7) shows the queue keeps accumulating from incidental IO while offline.

Why a sink module

Guest has no ServeRAID adapter (env.txt). Per the DF-4986/DF-5012 precedent, df5026.c wires the verbatim ipsd_strategy/ips_start_io_request structure (lock, bioqdisksort, swallow-on-error) to a raw D_DISK device; "offline" reproduces IPS_OFFLINE. The D-state/unkillable/external-release behavior demonstrated is exactly the failure mode the driver-side omission inflicts.

Artifacts

df5026.c, df5026_fixed.c (fix pattern), df5026_trigger.c, Makefile, build.sh, run.sh, run_ab.sh, build.log, run.log, run_fixed_ab.log, env.txt, fix.diff.

DF-5026 Verification Verdict

Status: reproduced (sink-level, house precedent DF-4986/DF-5012) — impact dos

Reproduced

run.log (original pattern, stock guest kernel, uname in env.txt):

1. Adapter taken "offline" (simulating ips_timeout's failed reinit, ips.c:354-358).
2. A single pread parks its bio(s): issuing process lands in D3/physstr (biowait) — PID 1275.
3. kill -9 delivered → process still present 2 s later (unkillable D-state).
4. Recovery poke drains the parked bios with EIO → process exits immediately ("gone").
5. The unload log line ("draining 6 parked bio(s)" after the poke's 7) demonstrates continued accumulation: every bio arriving while offline parks; none are ever completed by the driver pattern itself.

run_fixed_ab.log (A/B): with the fix pattern (strategy fail-fast + ips_start_io_request draining on terminal error), the same pread returns immediately r=-1 errno=5 (EIO) — no D-state, no residual process.

Source chain (cited)

• ips_disk.c:128-143 — ipsd_strategy enqueues unconditionally; no IPS_OFFLINE/IPS_TIMEOUT gate.
• ips_commands.c:246-247 — if (ips_get_free_cmd(sc, &command, 0) != 0) return; — the error code (EIO offline / EBUSY busy-or-resetting) is discarded; EBUSY-retry is correct behavior, EIO is terminal.
• ips.c:207-209 (EIO when OFFLINE), ips.c:220 (EBUSY when TIMEOUT), ips.c:137 & ips.c:358 (IPS_OFFLINE setters).

Impact ceiling: with a filesystem on ipsd, every page-in/write/fsync parks — local DoS that wedges the box (and root-on-ipsd = whole-system hang); attacker-relevant when the hardware faults or is made to fault (malicious device / broken HBA). Bucket: base:dev (same as DF-5012/DF-2066 twins).

Fix validation

• Behavioral: A/B above — the fixed pattern removes the wedge entirely (fix_baseline_reproduced=true, fix_patched_reproduced=false).
• Compile: fix.diff (ips_disk.c fail-fast + ips_commands.c drain) applied to the guest's /usr/src copy; full ips.ko module rebuilt -Werror clean (fix_validation.log). Sources restored afterward.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.