vinumioctl: resetstats() switch falls through drive_object->sd_object; reply->error uninitialized on no-match
Summary
resetstats() vinumioctl.c:427-502 case drive_object:432 no break no terminal return for index-out-of-range branch; msg->index >= drives_allocated falls through to case sd_object:446 may reset stats on unrelated subdisk. volume_object case:483 falls through to invalid_object:498 but at least sets EINVAL. reply->error never explicitly initialized at function entry so no-match exit returns user-supplied error byte verbatim. Fix: initialize reply->error=EINVAL at entry; ensure every case ends with return/break.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1743 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Add break; after the drive_object case body. | 847 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-1743 — PoC Verification Verdict
Category: raid (IN GENERIC)
Source: sys/dev/raid/vinum/vinumioctl.c:427-502
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; GENERIC-compiled, no HW)
Mechanism
resetstats() drive_object case has no break before sd_object case; a drive reset falls through to sd_object logic with msg->index interpreted as sd index, erroring or resetting the wrong object.
In GENERIC kernel build: YES (file compiled by X86_64_GENERIC)
Reproduction status
This finding is GENERIC-compiled but trigger requires specific runtime state: the vulnerable code path requires specific runtime state (specific device probe, RAID config, sysctl, or process context) not reproducible from the unprivileged audit guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Add break; after the drive_object case body.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): vinum resetstats() drive_object case has no break before sd_object case; drive reset falls through to sd_object logic with msg->index interpreted as sd index. Logic bug.
Verified recommended fix
REPRODUCED (source-only): vinum resetstats() drive_object case has no break before sd_object case; drive reset falls through to sd_object logic with msg->index interpreted as sd index. Logic bug.
Verdict
REPRODUCED (source-only): vinum resetstats() drive_object case has no break before sd_object case; drive reset falls through to sd_object logic with msg->index interpreted as sd index. Logic bug.
No comments yet.