DF-5355 -- pccard_function_init partial-allocation retry panics resource_list_add

Impact: deterministic kernel panic at evil-card insertion/boot (resource_list_add: resource entry is busy); non-panicking variants hold bridge windows. Physical-access DoS (16-bit PC Card socket).

Reproduce (verbatim rig -- shared with DF-2318/DF-5356)

# on the DragonFly guest (pristine /usr/src):
sh build.sh          # machine-extracts production pccard.c/subr_bus.c/cis code
./rig2 busypanic     # the DF-5355 scenario
sh run_matrix.sh matrix   # A/B: baseline vs df5355/df2318/df5356 fix variants

Success criterion (baseline):

pccard0: Allocation failed for cfe 0
RIG KERNEL PANIC: resource_list_add: resource entry is busy
RESULT busypanic: exit 42

With the fix (fixed_run.log): exit 0 -- cfe#0 unwinds, cfe#1 gets the window, the function attaches cleanly.

The full rig (all 7 scenarios incl. DF-2318/DF-5356) lives in ../DF-2318/; this pack is a self-contained copy.

Fix

fix.diff (== fixes/df5355.diff): unwind partial allocations at not_this_one -- release each busy entry's resource, clear rle->res, and delete it from the list before trying the next config entry. NOTE: this supersedes the originally-seeded fix, which omitted trle->res = NULL and itself panicked in resource_list_delete (see VERDICT.md). Validated by rig A/B + combined-fix kernel boot; never applied to sys/.

DF-5355 -- VERDICT

Verdict in one line

REPRODUCED (verbatim-rig level; deterministic across 3/3 runs) -- impact: panic. The verbatim production pccard_function_init (sys/bus/pccard/pccard.c:407-503) leaves a partially-allocated, res-busy resource-list entry when a card config entry fails mid-way (not_this_one, purge #if 0'd at :499-501); the next CFTABLE_ENTRY's resource_list_add for the same (type, rid) hits the verbatim production panic resource_list_add: resource entry is busy (sys/kern/subr_bus.c:2631). Hardware-gated kernel entry (no PCMCIA bridge in QEMU -- env.txt), proven on the byte-identical extracted code.

Upgrade over the seeded model

The seeded pack verified this with a hand-written model of the three code regions. This run replaces the model with the machine-extracted production code (DF-2319 verbatim-rig protocol): extract2.sh pulls pccard_function_init, the resource_list_* family and the whole attach/detach/CIS-parse chain byte-identical from the guest's /usr/src (sha256-gated: pccard.c 5b610669..., subr_bus.c 949f75de...; PCCARD_BYTE_IDENTICAL=yes, SUBR_BUS_BYTE_IDENTICAL=yes). The seeded model is preserved in seed_model/ for provenance; its CIS encoding knowledge (little-endian addr/len, length+1 semantics) carried over into the rig's tuple builders.

The reproduced chain (run.log)

CIS: VERS_1 + MANFID + CONFIG + CFTABLE#0(2 io ranges: anywhere + fixed 0x3F8) + CFTABLE#1(1 range: fixed 0x200). Bridge I/O window [0x110,0x2FF] (what a finite pcic/cbb window decodes; 0x3F8 is a legacy-occupied host range outside it).

1. verbatim pccard_attach_card -> verbatim CIS parse: both cfe entries decode cleanly (card.error=0 -- the gate at pccard.c:205 does not fire).
2. verbatim pccard_function_init on cfe#0 (pccard.c:425-451): * iospace[0] start=0 -> bus_alloc_resource grants window space -> resource_list_add(rl, IOPORT, rid=0, ...) + rle->res = r (:443-449) * iospace[1] fixed 0x3F8 -> bridge refuses -> goto not_this_one (:441-442) * the purge is #if 0'd (:499-501): rid-0 stays busy in rl * log: pccard0: Allocation failed for cfe 0 (verbatim DEVPRVERBOSE)
3. loop continues to cfe#1: iospace[0] fixed 0x200 -> granted -> resource_list_add(rl, IOPORT, rid=0, ...) (pccard.c:443) -> verbatim subr_bus.c:2619 resource_list_find returns the busy entry -> :2630-2631 if (rle->res) panic("resource_list_add: resource entry is busy")
4. rig prints RIG KERNEL PANIC: resource_list_add: resource entry is busy, exit 42 (kernel: system halted at card insertion / boot with card seated).

Every ingredient is card-controlled: the number of config entries, their io-range counts, addresses and lengths are all CFTABLE_ENTRY fields (pccard_cis.c:1023-1098), and the mixed anywhere/fixed request pattern is what real multi-function serial cards present.

Determinism: 3/3 identical (run.log in DF-2318's pack = full 7-scenario run; this pack carries the busypanic scenario logs).

Fix validation

• The SEEDED fix.diff was itself buggy: it called resource_list_delete without clearing rle->res, so the fixed code panicked in resource_list_delete: resource has not been released (first matrix run). Production pccard_function_free explicitly does rle->res = NULL after release (pccard.c:534) -- the unwind must too. fix.diff in this pack is the corrected, validated version (adds trle->res = NULL;).
• Single-fix A/B (matrix.log / fixed_run.log): busypanic exits 0 -- cfe#0 fails and unwinds, cfe#1 allocates 0x200 cleanly (io-windows-held=1), function attaches, devadded prints the pnpinfo string, zero leak. All six other scenarios unchanged (f5355 variant still crashes no_vers1 = DF-2318, still leaks reentry = DF-5356; controls green).
• Combined three-fix kernel: -Werror nativekernel rc=0, installed, booted (kernel #1); rig re-extracted from the RUNNING kernel's source and re-driven: busypanic clean (postboot_run.log in DF-2318's pack). Guest reset to clean-source snapshot afterwards.

Kernel references

• sys/bus/pccard/pccard.c:425 (cfe scan loop)
• sys/bus/pccard/pccard.c:429-440 (per-range bus_alloc_resource)
• sys/bus/pccard/pccard.c:443-449 (resource_list_add + rle->res = r)
• sys/bus/pccard/pccard.c:441-442 / :464-465 / :483-484 (goto not_this_one)
• sys/bus/pccard/pccard.c:496-501 (not_this_one; purge #if 0)
• sys/kern/subr_bus.c:2614-2644 (resource_list_add)
• sys/kern/subr_bus.c:2630-2631 (the panic)
• sys/bus/pccard/pccard_cis.c:1023-1098 (card-controlled iospace decoding)

Exploit chain

evil PC Card CIS (two CFTABLE_ENTRYs; first with one grantable + one ungrantable fixed io range, second with a grantable range) -> card insertion -> pccard_attach_card -> pccard_function_init partial allocation -> not_this_one without unwind -> next entry re-adds busy rid -> panic("resource_list_add: resource entry is busy") at insertion/boot. Deterministic local/physical DoS; no privilege boundary crossed (fixed panic site, no controllable data). Non-panicking variants (every entry failing mid-way) hold the granted bus windows until card removal.

Environment

Same guest/rig as DF-2318 (env.txt). Artifacts: run.log (baseline decisive), fixed_run.log (fix A/B), busypanic_pair.log (side-by-side), build.log, extract2_manifest.txt, matrix.log, seed_model/ (superseded hand model).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.