DF-4801 — the revive waitlist is never drained when a revive is abandoned: writers queue on sd->waitlist forever (uninterruptible, kill -9-proof, survives revive abort/detach)

• File: sys/dev/raid/vinum/vinumrevive.c:198-218 (the only drain in the tree), vinumrequest.c:327-355 (the append)
• Severity: Medium (permanent unkillable I/O hang + request leak; root starts the revive, unprivileged writers via a mounted filesystem are the victims; only a reboot clears it)
• Bucket: base:raid / dos
• Status: reproduced (4/4 writers hung, deterministic), fix validated on the guest

Root cause

A write that straddles the revive cursor is queued on sd->waitlist (launch_requests(), XFR_REVIVECONFLICT, vinumrequest.c:327-355) and its writer sleeps in biowait() — which has no PCATCH, so the sleep is uninterruptible. The ONLY code in the whole tree that drains sd->waitlist is the tail of a successful revive_block() call (vinumrevive.c:198-218). The revive itself is driven one block per ioctl by the userland vinum start process; when that process stops issuing ioctls — killed, SIGSTOPped, crashed, or simply not scheduled — the waitlist is orphaned:

• no set_sd_state() transition away from sd_reviving (down/stale/initializing/…) looks at sd->waitlist (vinumstate.c:104-296);
• subdisk detach / vinum stop / module unload never drain it (rg waitlist over sys/dev/raid/vinum/ shows exactly one drain site);
• the queued struct requests and their buffers leak permanently.

Result: every writer whose request was queued hangs forever, is immune to kill -9, and stays hung through an explicit revive abort (vinum setstate -f down).

Reproduction (guest, stock kernel, deterministic — no UAF race needed)

prime.c sends exactly ONE VINUM_SETSTATE(object_up, blocksize=64k) ioctl: one clean revive_block() runs (empty waitlist), the sd is now sd_reviving with the cursor at byte 64k, and nothing will ever drive it again. Four writers then hammer the straddle window [64k, 96k) (every write conflicts → waitlisted). hang.sh:

prime: error=35 msg=                       <- EAGAIN, sd "R 2%"
writer1..4: (frozen immediately, counters empty)
 918 D0     physstr  dd ... seek=18 ...    <- all four writers D-state
kill -9 -> all four STILL D-state          (">>> UNKILLABLE HUNG WRITERS <<<")
vinum setstate -f down vol.p1.s0
 -> all four STILL D-state                 (">>> STILL HUNG AFTER ABORT <<<")
S vol.p1.s0   State: down                  (revive aborted; nobody drained)

Writers target only the straddle window so the trigger never touches the REQUEST_DOWN / trailing-BAD-group launch path (the DF-4482/DF-4721 UAF) — the hang is shown in isolation, deterministically (run.log).

Fix (validated)

fix.diff adds drain_sd_waitlist(sdno) (steal the list atomically; relaunch each request if the sd just came up — exactly what revive_block()'s own drain would have done — otherwise fail it with EIO and free it), called from set_sd_state() on every actual transition out of sd_reviving (vinumstate.c hook). Aborting the revive now completes the queued writes:

-- after revive abort --
writers gone (drained: fix working)        (fix_run.log)

vs. the stock kernel's >>> STILL HUNG AFTER ABORT <<<.

Files

• hang.sh — the exact trigger (setup + prime + 4 straddle writers + kill -9 tests + abort test)
• prime.c — single-ioctl revive primer
• run.log — stock reproduction
• fix.diff — drain-on-abort (validated), stacks on the DF-4482 v2 fix
• fix_run.log — patched-module validation
• env.txt

DF-4801 verdict — REPRODUCED (permanent unkillable writer hang, deterministic), fix validated

• finding: sd->waitlist is drained ONLY from the tail of a successful revive_block() (sys/dev/raid/vinum/vinumrevive.c:198-218). The revive is driven one block per ioctl by userland vinum start; when that stops (killed, SIGSTOP, crash, scheduler starvation), queued conflicting writes (launch_requests(), vinumrequest.c:327-355) sleep in PCATCH-less biowait forever. No state transition (set_sd_state, detach, stop, unload) drains the list.
• guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (stock), mirrored concat volume on md drives.

Runs (stock)

One VINUM_SETSTATE(object_up, blocksize=64k) ioctl primes the sd into sd_reviving (cursor at 64k, empty waitlist, no drainer ever again); four writers hammer [64k,96k) — every write is XFR_REVIVECONFLICT and queues:

• all four writers freeze instantly, D-state (wchan physstr);
• kill -9 on writers AND their dd children: all four remain;
• vinum setstate -f down vol.p1.s0 (explicit revive abort): all four remain (>>> STILL HUNG AFTER ABORT <<<, run.log).

Deterministic (no race needed): the writers' requests are queued the moment they straddle the frozen cursor; the trigger deliberately avoids the DF-4482/DF-4721 launch paths so the hang shows in isolation. 4/4 writers hung; the requests and their buffers leak until reboot.

Unprivileged angle: any filesystem mounted on the volume turns every user write that straddles a frozen/abandoned cursor into a permanent unkillable hang of that user's process.

Fix validation

fix.diff: drain_sd_waitlist() (atomic steal; relaunch if the sd came up, else biodone(EIO)+freerq) hooked into set_sd_state() on every real transition out of sd_reviving. Patched module, same workload: writers still freeze while queued (expected), and the abort drains them — post-abort ps shows no dd left (fix_run.log), vs. stock's four immortal D-state writers.

fix_status: fixed (baseline_reproduced=1, patched_reproduced=0).

Residual (documented in fix.diff): transitions that bypass set_sd_state's commit point (e.g. the driveoffset < 0 early path, direct slot reuse) are not covered; a full redesign would keep the waitlist in the sd's own teardown.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.