DF-4759 — vinum module teardown has no real synchronization: MOD_UNLOAD TOCTOU vs vinumopen, plus the state > volume_down gap skips open-but-down volumes (UAF-class teardown race; privileged parties)

• Files: sys/dev/raid/vinum/vinum.c:171-189 (vinum_inactive), vinum.c:295-358 (vinum_modevent MOD_UNLOAD), vinum.c:198-259 (free_vinum), racing vinum.c:372-476 (vinumopen) and the strategy path.
• Severity: Low (all racing parties are privileged: kldunload needs root; volume/plex/sd device nodes are 0640 root:operator — operator ≈ raw-disk access ≈ root).
• Status: untested (analysis only — nondeterministic privileged race; the same unlocked-teardown class was guest-confirmed by the sibling finding DF-4478 on vinumstate/vinumioctl).

What

MOD_UNLOAD decides it is safe to free everything with two non-atomic heuristics, then frees DRIVE/SD/PLEX/VOL and bzeros vinum_conf with no lock held for the duration:

1. TOCTOU: vinum_inactive(1) returns "inactive", and only afterwards can another process open() a vinum node; vinumopen (e.g. VOLUME/RAWSD paths, vinum.c:386-455) then writes vol->flags |= VF_OPEN / sd->flags |= VF_OPEN into arrays that free_vinum() may concurrently Free() (vinum.c:213-256) — a write-after-free window between the check and the frees, and a use-after-free for any strategy/close issued on the fd afterwards. (The open side also takes no lock_config.)

2. State gap: vinum_inactive only counts a volume as open when VOL[i].state > volume_down && (VOL[i].flags & VF_OPEN) (vinum.c:181-182). A volume that was opened while up and has since gone volume_down (drive error, vinum set state down) keeps its open fd and VF_OPEN flag but is skipped by the check → kldunload proceeds to free the arrays under the live fd.

3. Flag ≠ refcount: VF_OPEN/VF_DAEMONOPEN are booleans set on every open and cleared on the first close (vinum.c:398/453 vs 502/521/534/543-545) — two open superdev/controld fds + one close leaves the modules' "is anything open?" answer wrong in both directions (see also DF-4760's use of the same flag).

Why Low / not guest-verified

Both sides of every interleaving are privileged (root for kldunload and the superdev; operator for volume/rawplex/rawsd nodes — operator has raw disk R/W on this system class). The window is small and the family-class outcome (tearing/UAF) is already guest-demonstrated by DF-4478. Filing as Low with the concrete gaps cited; a deterministic PoC would need a purpose-built driver harness.

Recommended fix

Hold lock_config() across vinum_inactive()'s decision and the whole of free_vinum()/dev teardown in MOD_UNLOAD; make vinumopen take lock_config() around its state test + VF_OPEN set; change the open-check to (VOL[i].flags & VF_OPEN) regardless of state (or keep per-object open refcounts instead of boolean flags).