DF-4140 — vinum drive free-list grows without bound: OOB write past the

16-entry drive->freelist heap array with attacker-chosen u64 pairs

Impact

Unbounded kernel heap buffer overflow (16 bytes per extra entry, unlimited entry count, content = two attacker-influenced u_int64_ts) from ordinary vinum configuration operations — placing subdisks at specific driveoffsets, or returning fragmented space. Reproduced on the guest: the overflow value (0x163 = one of our subdisk end offsets) was later dereferenced as a kernel pointer by prop_object_release → page fault.

Root cause

• sys/dev/raid/vinum/vinumio.c:143-145 — the free list is allocated once with INITIAL_DRIVE_FREELIST = 16 entries (vinumvar.h:191) = Malloc(16 * sizeof(struct drive_freelist)) = 256 bytes. drive->freelist_size is set to 16 and never referenced again anywhere in the driver (no growth, no capacity check).
• sys/dev/raid/vinum/vinumconfig.c:429-439 (give_sd_to_drive, "specific offset" case 3) — placing a subdisk strictly inside a free entry splits it and does drive->freelist_entries++; drive->freelist[fe+1].offset = sdend; drive->freelist[fe+1].sectors = dend - sdend; with no bound.
• sys/dev/raid/vinum/vinumconfig.c:696-705 (return_drive_space, case 3) — returning non-contiguous space inserts an entry the same way.

Every fragmented placement adds one 16-byte entry past the 16th. sdend is fully attacker-chosen (the driveoffset + len from the config line); sectors is derived. 17th placement = first OOB write; N placements ≈ 16·(N−16) bytes past a kmalloc(256).

Reachability

• root/operator vinum create with multiple sd ... driveoffset Xs len Ys detached lines at interior offsets (exactly how the PoC drives it),
• any crafted vinum-labelled disk — the identical config_subdisk → give_sd_to_drive path runs in VF_READING_CONFIG mode,
• space return paths (remove sd, vinum move) fragment via return_drive_space the same way.

Build / run

cfgfrag2.sec (60 one-sector sds at 2-sector pitch) goes to the vinum config area of a crafted drive (see DF-4133 pack for label crafting), then:

vinum read /dev/vn0s1a        # freelist_entries: 1 -> ~61 in a 16-slot array
# repeat read after VINUM_RESETCONFIG + relabel to consume the smashed zone:
./vreset; dd if=lbl.bin of=/dev/vn0s1a bs=512 seek=8 conv=notrunc
vinum read /dev/vn0s1a        # -> panic (see panic.txt)

Expected (vulnerable kernel)

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x163                       <- our sdend value (300+2*27+1)
Stopped at prop_object_release+0x3d: movq (%rbx),%rax

(the first read usually survives — the corruption is dormant until the 256-byte zone object adjacent to freelist[] is used; a second cycle crashes deterministically in this run.)

Fix

Grow the array when entries reach capacity (the field for it already exists):

--- a/sys/dev/raid/vinum/vinumconfig.c
+++ b/sys/dev/raid/vinum/vinumconfig.c
@@ -429,6 +429,15 @@
        } else {                    /* 3 or 4 */
            drive->freelist[fe].sectors = sd->driveoffset - drive->freelist[fe].offset;
            if (dend > sdend) {             /* 3: space at the end as well */
+           if (drive->freelist_entries >= drive->freelist_size) {
+               EXPAND(drive->freelist, struct drive_freelist,
+                  drive->freelist_size, INITIAL_DRIVE_FREELIST);
+               if (drive->freelist == NULL)
+               return;
+           }
            if (fe < (drive->freelist_entries - 1)) /* not the last one */

(the same guard is needed in return_drive_space before the insert at :696-705.)