DF-4594

vinum_scandisk() early returns (ENOENT / longjmp) leave VF_READING_CONFIG set and leak drivelist — daemon config saves silently wedged

Summary

The flag and allocation happen before both early exits which skip the only cleanup (at the function tail). The stuck flag makes the daemon refuse every saveconfig - all subsequent configuration changes silently never persisted until some finish_config runs; drivelist leaks per call. REPRODUCED on guest with a bare-ioctl trigger (saveconfig md5 frozen after the wedge; CLI create resumes saving); patched module validated. Free+flag-clear-on-early-returns fix.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CWE: CWE-772
File: sys/dev/raid/vinum/vinumio.c
Lines: 682-753
Area: dev
Discovered: 2026-09-21
Updated: 2026-09-21

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: dos
Confidence: certain
Tested: 2026-09-21 23:49:29
Attempts: 3
Runtime: 120s
Code hash: 7871166ca6921730
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cc -O -o /tmp/stick /tmp/stick.c
Run cmd: sh run.sh (root on guest); core check: /tmp/stick /dev/vn1 then vinum saveconfig then compare dd-if=/dev/md0s0a-skip=8-count=1 md5

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-09-21 23:49:29
Runtime: —
Kernel: per-fix-DF-4594
fix.diff: findings/poc/DF-4594/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4594 · 7 files

File	Type	Size
stick.c	—	1.9 KB	view raw
run.sh	—	151 B	view raw
run.log	—	4.1 KB	view raw
run.patched.log	—	4.2 KB	view raw
fix.diff	—	650 B	view raw
build.sh	—	100 B	view raw
env.txt	—	291 B	view raw

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

Patched module: after the identical stick trigger, vinum saveconfig again updates the drive header (md5 changes), i.e. persistence is no longer wedged; no other behavior change observed.

run.patched.log 'DF-4594 evidence': post-stick save cae4f0c8f15581482ef848d905a31c25 -> 861d727dc568436abc2e6ea21af1b063

↓ fix.diffper-fix-DF-4594

Confirmed kernel references

Detail

Evidence (decisive lines)

run.log 'DF-4594 evidence': control save 8898f0fc.. -> a7f08ec2.. then post-stick a7f08ec2.. -> a7f08ec2.. (identical); run.patched.log: post-stick cae4f0c8.. -> 861d727d.. (changed); stick.c is the 30-line bare-ioctl trigger

PoC changes

No seed PoC. Had to fix two guest-reality details: the ioctl magic letter is 'F' (vinumio.h:39), and the non-debug superdev is /dev/vinum/control ('Control' is WRONGSUPERDEV and open() fails ENODEV).

Verified recommended fix

Free drivelist and clear VF_READING_CONFIG on both early returns of vinum_scandisk() (see fix.diff).

Verdict

Reproduced: after a bare VINUM_CREATE ioctl carrying 'read /dev/vn1' (scandisk ENOENT early return at vinumio.c:752), vinum saveconfig leaves the drive header byte-identical -- the daemon's save gate (vinumdaemon.c:126) sees VF_READING_CONFIG stuck set, so all config persistence is silently suppressed until a finish_config runs; drivelist is also leaked. Trigger is root-only (or the vinum.drives loader tunable at boot), hence Low severity despite reliable reproduction. Fix (Free + flag clear on both early returns) validated in the patched module: post-stick saves resume changing the header.