⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1821

vinumraid5: missing plex->subdisks bounds check enables division-by-zero panic via config-race

Summary

bre5 uses (plex->subdisks-1) as divisor at 153/184/201 and plex->subdisks as modulo at 165 NO validation subdisks>=2. Normally *diskaddr>=plex->length guard at 142 prevents reaching these when subdisks<2 because plex->length=0 for <2-subdisk plex. But VINUM_REMOVE and VINUM_DETACH modify plex->subdisks WITHOUT lock_config() while vinumstrategy/bre5 also lock-free. Window between plex->subdisks-- (vinumioctl.c:635 or vinumconfig.c:1783) and update_plex_config updating plex->length: concurrent I/O reads stale non-zero plex->length passes 142 then hits /0 at 153 or 165. subdisks==1: /0 at 153 (stripesize*0). subdisks==0: /0 at 165 also sdnos NULL freed. 2-subdisk RAID4/5 plex syntactically valid. Fix: if(plex->subdisks<2) return REQUEST_DOWN after line 142; VINUM_REMOVE/DETACH should lock_config.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1821 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 634 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1821 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/raid/vinum/vinumraid5.c:142-201. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

vinum (loaded as module, not in GENERIC; also root-only). Source: bre5 uses (plex->subdisks-1) as divisor at L153/184/201; for a degenerate <2-subdisk plex this divides by zero. Normally the diskaddr>=plex->length guard at L142 prevents reaching these because plex->length=0 for such plexes, but the divide-by-zero is still latent if the invariant is broken.

Guard at function entry: if (plex->subdisks < 2) return REQUEST_EOF before any division.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1821/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Guard at function entry: if (plex->subdisks < 2) return REQUEST_EOF before any division. Full git-apply-able diff in findings/poc/DF-1821/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/raid/vinum/vinumraid5.c:142-201. vinum (loaded as module, root-only). bre5 uses (plex->subdisks-1) as divisor at L153/184/201; degenerate <2-subdisk plex divides by zero. Normally diskaddr>=plex->length guard at L142 prevents reach because plex->length=0, but the latent div-by-zero remains. HW/module gated.