DF-5445 — unbounded resource-data ingestion in pnp_read_resources()/pnp_create_devices() (sys/bus/isa/pnp.c)

What

Two unbounded-ingestion faces, both card-controlled:

1. No-END stream: pnp_read_resources() (pnp.c:536-581) loops until an END tag or a read error. A card that keeps the resource-data-ready bit asserted forever (and never sends tag 0x78) keeps the loop running and pnp_read_bytes() growing the kmalloc buffer in 1 KiB steps — no cap on total length — until kernel memory is exhausted. The kldload/boot thread spins forever (kernel wedge).

2. Endless logical devices: each PNP_TAG_LOGICAL_DEVICE processed by pnp_create_devices() (pnp.c:428-460) allocates a device + ivars + csnldn (24 B, also never freed) and pnp_parse_resources() kmallocs 9 × sizeof(struct isa_config) = 8640 B per slice. ~6 bytes of card data → >1 KB of permanent kernel allocation (measured 164× amplification); ldn is an unbounded int even though the LDN register is 8-bit.

Rig

Same rig/ as DF-5443. Module hack_dfc (script 3): card synthesizes an endless tag stream (no END). Module hack_dfd (script 4): card sends 6000 logical-device tags + END (finite amplification demo).

Build / Run

(cd /usr/src/sys/bus/isa/hack_dfc && make obj && make depend && make)
(cd /usr/src/sys/bus/isa/hack_dfd && make obj && make depend && make)
timeout 50 ssh ... 'kldload .../rigdfc.ko'      # never returns (RC=124)
kldload .../rigdfd.ko                           # returns; vmstat -m diff

Expected

Baseline: * rigdfc: kldload never returns (local timeout RC=124); serial log shows kmalloc growth without bound (5.57 MB single allocation at t+50 s, 12.4 MB at t+125 s, still growing); guest degraded. * rigdfd: M_DEVBUF 208K→6.11 MB permanent (+5.9 MB for a 36 KB card stream), 211→11.9K chunks, 6000 children.

Fixed kernel (fix.diff: PNP_MAX_RESOURCE_DATA = 64 KiB cap in pnp_read_resources, 256-LDN cap in pnp_create_devices): * rigdfc: kldload returns quickly with "too much resource data". * rigdfd: capped at 256 logical devices, "too many logical devices".

DF-5445 VERDICT — REPRODUCED (kernel wedge / unbounded memory exhaustion; DoS)

Bottom line

Both unbounded-ingestion faces demonstrated live on the baseline kernel; both eliminated by the caps in fix.diff.

Face 1 — no-END stream (wedge)

Card keeps resource-data-ready asserted forever, never sends tag 0x78. pnp_read_resources() (pnp.c:546-574) has no total-length cap; pnp_read_bytes() grows the buffer in 1 KiB steps without bound.

Observed (baseline #0):

• kldload rigdfc.ko — never returns (50 s local timeout, RC=124),
• kmalloc growth: single allocation 5.57 MB at t+50 s → 12.41 MB at t+125 s, still climbing (verbatim samples in run_endless.log),
• parallel vmstat ssh starved (RC=124); guest never recovers — reset required.

Face 2 — logical-device spray (permanent memory amplification)

6000 PNP_TAG_LOGICAL_DEVICE tags (36 KB stream, rigdfd.ko):

• M_DEVBUF 208K → 6.11 MB permanent (+5.9 MB), chunks 211 → 11.9K (run_ldspray.log) — ~164× amplification, unbounded (ldn is an int; the LDN register is 8-bit; csnldn at pnp.c:453 is never freed);
• 6000 children created, found=1, load returns.

Fix validation (kernel #1)

• Endless stream: completes in 4.26 s, pnp_read_resources: too much resource data ×7, RC=0, guest healthy (fix_run_endless.log).
• LD spray: stops at 256 logical devices — isa0: too many logical devices, devbuf delta +258 K vs +5.9 MB baseline (fix_run_ldspray.log).

Fix

fix.diff: PNP_MAX_RESOURCE_DATA 64 KiB cap in pnp_read_resources() + 256-LDN cap in pnp_create_devices(). Build log: DF-5443/fix_build.log.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)