DF-5393 — isa_find_memory unbounded candidate loop (boot stall)

What this proves

isa_common.c:isa_find_memory() (lines 128-148) searches a candidate window for each PnP memory descriptor:

for (start=..., end=..., size=..., align=...;
     start + size - 1 <= end;            /* no wrap guard */
     start += MAX(align, 1)) {           /* align can be 1 */
        bus_set_resource(...); res[i] = bus_alloc_resource(...);
        if (res[i]) break;
}

Nothing bounds the number of rman allocation attempts: iteration count = (end-start)/align, attacker-controlled up to 2^32 (MEMORY32_RANGE supplies 32-bit start/end and a 32-bit align — pnpparse.c:295-300 — with align=1 perfectly legal; MEMORY_RANGE only coerces align==0 to 0x10000, memory32 doesn't even do that). When the window is already claimed (every bus_alloc_resource fails — arrangeable by resource conflicts, which a crafted card's other descriptors or system usage provide), the loop grinds the resource manager at boot with zero progress.

Reproduced (measured)

The pnphack harness (see ../DF-5392/, same source) creates a child whose single MEMORY32_RANGE descriptor spans a 4MB window fully covered by a resource held by a second child. isa_find_memory() then iterates all 4,194,304 candidates at align=1:

PNPHACK[stall]: ice[0] prio=0 nmem=1 nport=0 nirq=0 ndrq=0
PNPHACK[block]: window [0xe0000000-0xe03fffff] held: YES
...
PNPHACK: config_cb(p61)   ... t=1791069799.927439 (+302946 usec since identify)
PNPHACK: config_cb(stall) ... t=1791069800.684457 (+1059964 usec since identify)

~757ms for a 4MB window ⇒ ~0.18 usec/iteration. Extrapolation to the maximum crafted window (start=0, end=0xFFFFFFFF, size=1, align=1): 2^32 * 0.18us ≈ 13 minutes per descriptor, and up to ISA_NMEM=8 descriptors per config, 9 configs per logical device, unbounded logical devices per card — hours of boot-time kernel lockup from a handful of PnP bytes, with the bus probe serialized behind it.

Run: kldload /usr/obj/usr/src/sys/bus/isa/hack_a/pnphack.ko (same module as DF-5392 run-A; the stall children are created unconditionally).

Fix

isa_find_memory gains a wrap guard (start <= end && start + size - 1 <= end) and a per-range attempt cap (ISA_FIND_MAX_TRIES = 65536, ~12ms worst case) — included in ../DF-5392/fix.diff. On the patched kernel the stall child's callback returns in single-digit milliseconds (see fix_run_a.log in ../DF-5392/).

DF-5393 — VERDICT

Finding: isa_find_memory() (sys/bus/isa/isa_common.c:128-148) iterates a PnP-supplied candidate window one address at a time with no attempt cap and no wrap guard; iteration count is attacker-bounded only by (end-start)/align, up to 2^32 rman alloc/free cycles per descriptor at boot.

Reproduced: yes (measured, dos). Guest DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC) under QEMU/KVM. The pnphack KLD (sources and logs in ../DF-5392/) registers a child with a single 4MB MEMORY32_RANGE window ([0xE0000000, 0xE03FFFFF], size=1, align=1) fully covered by a resource held by a blocker child. The real isa_driver_added() → isa_assign_resources() → isa_find_memory() path then iterates every candidate:

• callbacks: p61 child done at +302,946us; stall child at +1,059,964us → ~757ms spent in isa_find_memory for 4,194,304 iterations (~0.18us/iteration, serial console timestamps in run_a.log).
• the loop ends with the device correctly failing ("(null) can't assign resources (memory)") — pure CPU burn, no error.

Ceiling: a crafted card supplying start=0/end=0xFFFFFFFF/size=1/align=1 (MEMORY32_RANGE allows all of these — pnpparse.c:295-300, and unlike MEMORY_RANGE (pnpparse.c:267-269) nothing coerces a zero/one align) burns ~13 minutes per descriptor; ×8 descriptors per config ×9 configs per logical device compounds to hours of unresponsive boot, all inside the single-threaded ISA probe (isa_probe_children).

Threat: crafted ISA-PnP card / emulated PnP device (hardware-supplied), or any future isa_add_config caller. Not a local unpriv-user trigger.

Impact: dos (boot-time kernel CPU lockup). No memory corruption on this path (reads of ic_mem[i] are within the count-clamped arrays — assuming DF-5392's poisoning is fixed).

Fix: wrap guard + ISA_FIND_MAX_TRIES(65536) cap in isa_find_memory — part of ../DF-5392/fix.diff; validated on the patched kernel: the stall child's disable callback fires ~immediately (milliseconds; see ../DF-5392/fix_run_a.log timestamps) instead of +757ms.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)