kern/60733: kmem_intr_alloc(..., KM_SLEEP) mistake isn't detected

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60733
>Category:       kern
>Synopsis:       kmem_intr_alloc(..., KM_SLEEP) mistake isn't detected
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 16 10:35:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The Net_intr_BSD Allocation, Asleep
>Environment:
>Description:

	The kmem_intr_alloc function is meant to be used for (mostly
	legacy) code paths that attempt allocation in interrupt
	context.  In such contexts, callers MUST be prepared to handle
	allocation failure gracefully, and MUST NOT sleep.  So it is
	always an error for callers outside subr_kmem.c to attempt
	kmem_intr_alloc(..., KM_SLEEP).

	However, while there is an assertion to forbid kmem_alloc(...)
	in interrupt context, there is no assertion to forbid
	kmem_intr_alloc(..., KM_SLEEP).

	Currently kmem_alloc is (mostly) just a wrapper around
	kmem_intr_alloc with an assertion:

    408 void *
    409 kmem_alloc(size_t size, km_flag_t kmflags)
    410 {
...
    413 	KASSERT(!cpu_intr_p());
    414 	KASSERT(!cpu_softintr_p());
    415 
    416 	v = kmem_intr_alloc(size, kmflags);
...
    421 	KASSERT(v || (kmflags & KM_NOSLEEP) != 0);
    422 	return v;
    423 }

	https://nxr.netbsd.org/xref/src/sys/kern/subr_kmem.c?r=1.89#404

>How-To-Repeat:

	code review

>Fix:

	Factor the bulk of the logic into an internal subroutine, say
	kmem_internal_alloc, so that that instead of

	kmem_alloc
	-> assert not intr context
	-> kmem_intr_alloc
	   -> (allocation logic)

	the call graph will be

	kmem_alloc
	-> assert not intr context
	-> kmem_internal_alloc
	   -> (allocation logic)

	kmem_intr_alloc
	-> assert not KM_SLEEP
	-> kmem_internal_alloc
	   -> (allocation logic)