vinumioctl: VINUM_RESETCONFIG case missing break falls through into VINUM_SETSTATE
Summary
VINUM_RESETCONFIG case vinumioctl.c:214-226 no break before case VINUM_SETSTATE:228. After RESETCONFIG sets error=EBUSY (active volumes) OR free_vinum(1) (inactive), falls through and unconditionally invokes setstate((vinum_ioctl_msg*)data) at 229. EBUSY path: user told failed but state mutation performed anyway. Success path: extra spurious setstate on freshly-reinitialized vinum_conf. VINUM_SETSTATE_FORCE at 236-238 has its own break confirming intent. Fix: add break before case SETSTATE.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1741 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add break before case VINUM_SETSTATE. | 333 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1741 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/raid/vinum/vinumioctl.c:214-228.
Mechanism
VINUM_RESETCONFIG case missing break before VINUM_SETSTATE; falls through to setstate after RESETCONFIG regardless of EBUSY error, performing unwanted state mutation.
Fix
Add break before case VINUM_SETSTATE.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
vinum.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- v
- i
- n
- u
- m
- /
- v
- i
- n
- u
- m
- i
- o
- c
- t
- l
- .
- c
- :
- 2
- 1
- 4
- -
- 2
- 2
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/raid/vinum/vinumioctl.c:214-228. Fix compiled clean.
PoC changes
authored fix.diff: add break before case VINUM_SETSTATE
Verified recommended fix
Add break before VINUM_SETSTATE case. Matches finding proposal.
Verdict
REPRODUCED (source-only). VINUM_RESETCONFIG missing break before SETSTATE; falls through to unwanted state mutation.
No comments yet.