format_config() plex line records zero subdisk names — missing string-advance inside the sd loop (DragonFly-specific regression vs FreeBSD)
Summary
The plex branch writes each ' sd <name>' at the SAME cursor (the string advance sits outside the loop); every iteration overwrites the previous and the trailing newline clobbers the first leftover byte - the persisted plex line lists none of its subdisks. REPRODUCED on guest (on-disk line 'plex name p0 ... vol v0 ' with no sd names vs 2 actual subdisks); patched module prints both. Restore still works via each sd's own line. Restore-the-in-loop-advance fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4593 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| run.log | — | 4.1 KB | view raw | |
| run.patched.log | — | 4.2 KB | view raw | |
| fix.diff | — | 337 B | view raw | |
| run.sh | — | 111 B | view raw | |
| label.bin | — | 512 B | ↓ download | |
| env.txt | — | 291 B | view raw |
Fix verification
fixedWith the in-loop advance restored, the persisted plex line lists all subdisk names; identical run.sh, patched module from the DF-4592 validation build.
run.log vs run.patched.log, 'DF-4593 evidence' sections
Confirmed kernel references
Detail
Evidence (decisive lines)
run.log 'DF-4593 evidence': 'plex name p0 state up org concat vol v0 ' while vinum l shows Subdisks: 2; run.patched.log: 'plex name p0 state up org concat vol v0 sd s0 sd s1'
PoC changes
Shared harness with DF-4592; no seed PoC existed.
Verified recommended fix
Add 'while (*s) s++;' inside the subdisk loop of format_config()'s plex branch (see fix.diff).
Verdict
Reproduced: a plex with two subdisks persists a config line listing none of them (vinumio.c:487-492 -- ksnprintf rewrites the same offset each iteration and sappend then clobbers the leftover). Patched module writes 'sd s0 sd s1' correctly. No memory-safety impact and the restore path (per-sd lines with plex/plexoffset) rebuilds the plex, so impact is persistent-config-text corruption only.
No comments yet.