DF-5048 — bios submitted to a wedged IDA controller park forever: unkillable D-state issuers, unbounded bio_queue (DF-5026 pattern)

File: sys/dev/raid/ida/ida_disk.c (pass 2, GLM 5.3) Bucket: base:dev | Severity: Low | Pattern: DF-5026 (ips parked bios)

What the bug is

idad_strategy() (sys/dev/raid/ida/ida_disk.c:144-189) validates softc/write-protect/zero-length locally and then hands the bio to the controller with no failure path of its own:

    bio->bio_driver_info = drv;
    crit_enter();
    devstat_start_transaction(&drv->stats);
    ida_submit_buf(drv->controller, bio);      /* ida_disk.c:175 */
    crit_exit();

ida_submit_buf() (sys/dev/raid/ida/ida.c:364-370) sorts the bio onto ida->bio_queue and calls ida_construct_qcb + ida_start. There is no route to biodone() except a controller completion:

• ida_construct_qcb silently returns when QCBs are exhausted (ida.c:385-387) — the bio stays parked in bio_queue;
• ida_start stops when the FIFO is full (ida.c:429-431);
• ida_done is the only reaper (ida.c:498-537), and it runs only from ida_intr (completions) or ida_wait (internal commands);
• the driver has no watchdog, no timeout, no offline/fail state, and no detach-time flush — nothing in the driver ever fails a parked bio.

If the controller wedges (stops delivering completions — hardware fault, PCIe error not surfaced, box being torn down), every bio parks forever. Each issuer sleeps in biowait in an unkillable D-state, all mounted filesystems on idad volumes hang, and bio_queue grows without bound while the VM page daemon stalls on dirty buffers — a system-wide livelock that only a reboot clears. Exactly the DF-5026 ips pattern, with the aggravation that IDA has not even an offline flag to gate on.

Threat model / trigger

Requires an IDA controller that stops completing I/O (genuine hardware wedge). No unprivileged or software-only trigger — hence Low (DF-5026 was Medium because an IPS adapter can be switched offline by configuration commands without hardware failure; IDA has no such knob).

PoC / verification status

Hardware-gated: no Compaq SMART/IDA device on the audit guest (env.txt: pciconf shows no 0x0e11 function; no /dev/idad*). The code trace above is line-accurate — there is literally no biodone reachable for a parked bio outside ida_intr/ida_done.

Fix

1-second callout watchdog: if work has been pending continuously for 60 seconds, fail everything queued with ETIMEDOUT and keep failing new arrivals (fix.diff, ida.c + idavar.h).

Reproduce (on hardware)

# IDA box with a mounted idad filesystem; wedge the controller (e.g. trigger
# a PCI error / stall the card in a test jig):
cat /dev/idad0 > /dev/null    # parks in D-state forever; ps shows 'D*' state
                              # bio_queue grows; box needs hard reset

DF-5048 VERDICT — parked bios / no completion path on a wedged IDA controller

status: untested (hardware-gated) | impact: none demonstrated (local DoS class) | confidence: likely

Reproduced?

No. Requires a physical Compaq SMART/IDA controller that stops completing I/O. Guest evidence (env.txt): no 0x0e11 PCI function, driver never attaches, /dev/idad* does not exist. Untested = hardware absent.

Why the finding is real (trace)

Completion-flow enumeration — there is no other biodone for bios that enter ida_submit_buf:

1. idad_strategy local error paths all biodone (ida_disk.c:153-156, 161-164, 169, 179-188) — those are fine (this is what DF-5012 fixed for mfi; ida already has it).
2. The submit path (ida_disk.c:172-177) -> ida_submit_buf (ida.c:364-370): bioqdisksort(&ida->bio_queue, bio) + ida_construct_qcb + ida_start.
3. ida_construct_qcb (ida.c:372-417): pops a bio only when a free QCB exists; out of QCBs -> return, bio parked (:385-387). Popped bios become qcbs queued for ida_start (:416).
4. ida_start (ida.c:424-440): submits while FIFO not full; else breaks.
5. The ONLY biodone for these bios is idad_intr (ida_disk.c:213-226) called from ida_done (ida.c:530-533), reached only from ida_intr (ida.c:470-493, hardware completions) — or ida_wait for internal commands (never for disk bios).
6. No callout/watchdog/timeout exists anywhere in ida.c or ida_disk.c (verified by grep: no callout, no timeout, no offline flag in idavar.h:122-124 — flags are ATTACHED/FIRMWARE/INTERRUPTS only).

Therefore: controller delivers no completion => QCBs never return to free_qcbs => QCB pool exhausts after IDA_QCB_MAX=256 requests => all further bios park in bio_queue forever => biowait sleeps are unkillable D-states; dirty-buffer pressure stalls the VM; queue is unbounded. System-wide hang until reboot. Family precedent: DF-5026 (ips, Medium — reachable via adapter-offline config; here only via a real hardware wedge, hence Low).

Not a duplicate of DF-1915/DF-4837 (ida.c): those cover detach-time freeing and DMA-direction corruption; this covers the hang/livelock from absent completion paths.

Fix assessment

fix.diff adds a 1 Hz callout watchdog (ida.c + idavar.h): 60 consecutive ticks with pending work and no drain => fail all queued bios with ETIMEDOUT+B_ERROR and keep failing new arrivals, so issuers become killable and the queue cannot grow unbounded. 60s is far beyond any real SMART-array latency; false-positive risk under extreme (but live) load is the accepted tradeoff, same remedy family as DF-5026's fix. fix_status=not_testable: no IDA hardware on the guest to build/validate a patched kernel.

Bottom line

Real absence-of-failure-path defect, code-certain, hardware-gated. Low.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.