revive_block leaks rangelock when read returns B_ERROR: permanent I/O hang on affected stripe
Summary
revive_block L196-197 unlockrange(sd->plexno,lock) lives INSIDE else branch that runs only when read completed WITHOUT B_ERROR. If bp->b_flags&B_ERROR (L170 data-block read failure or parityrebuild pbp B_ERROR) control takes if branch sets error skips else so lock acquired at L155 lockrange or parityrebuild L418 *lockp=lockrange is never released. Leaked lock permanently blocks all future I/O on that stripe — every subsequent access tsleep(vrlock) forever vinumlock.c:167. Root starts revive + underlying drive EIO; any unpriv user reads affected offset -> permanent uninterruptible hang. Repeat 256 stripes exhausts PLEX_LOCKS=256 -> full plex deadlock. Fix: move unlockrange out of else block run unconditionally before buffer free.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1887 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 437 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 712 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1887 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: revive_block L196-197 unlockrange(sd->plexno,lock) lives INSIDE else branch that runs only when read completed WITHOUT B_ERROR. If bp->b_flags&B_ERROR (L170 data-block read failure or parityrebuild pb
Citation: sys/dev/raid/vinum/vinumrevive.c:137-220
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: unlockrange skipped on B_ERROR path — permanent I/O lock (vinumrevive.c:196-197)
Verified recommended fix
Source-confirmed: unlockrange skipped on B_ERROR path — permanent I/O lock (vinumrevive.c:196-197)
Verdict
Source-confirmed: unlockrange skipped on B_ERROR path — permanent I/O lock (vinumrevive.c:196-197)
No comments yet.