⬢ DragonFlyBSD Kernel Audit
DF-2644 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
{
 "finding_id": "DF-2644",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "REPRODUCED on fault-injection kernel A (stock + sysctl-gated EIO injector with byte-exact real-media semantics, volume-gated to the 512MB test fs): sync on a PFS whose iroot chain cannot be re-read panics with Fatal trap 12, fault VA 0x200, 'Stopped at hammer2_xop_inode_flush+0x39c: repe movsq' - exactly the unguarded 'pmp->pfs_iroot_blocksets[clindex] = chain->data->ipdata.u.blockset' at hammer2_flush.c:1336-1337 with chain->data == NULL after hammer2_chain_load_data EIO (chain.c:1003-1008). The designed handlers one frame away ('hammer2: chain error during flush', 'PARENT ERROR DURING FLUSH LOCK') demonstrably work; this single deref ignores both chain->error and the discarded hammer2_flush() return. Fix validated on kernel B (only delta = fix.diff): identical workload+message sequence passes the site with no fault; residual later panic is the unrelated pre-existing chain.c:3112 KKASSERT(parent->error==0) via create/strategy retry paths (documented, belongs to chain.c audit).",
 "exploit_chain": "",
 "evidence": [
  "findings/poc/DF-2644/panic.txt (kernel A serial: chain-error handler messages then Fatal trap 12 VA 0x200 at hammer2_xop_inode_flush+0x39c)",
  "findings/poc/DF-2644/fix_run.log (kernel B: same sequence, NO xop_inode_flush fault, residual 3112 panic)",
  "findings/poc/DF-2644/fix_run_partial_3112.txt (kernel B arm=100000 variant, annotated contrast vs kernel A)",
  "findings/poc/DF-2644/inject.diff (environment simulator, never applied to the audited sys/ tree)",
  "findings/poc/DF-2644/fix.diff (the fix: guard + flush_error propagation)",
  "findings/poc/DF-2644/run_df2644_inj.sh, validate_fix_df2644.sh (triggers)",
  "findings/poc/DF-2644/build_kernelA2.sh / build_kernelB.sh (nativekernel build drivers)",
  "findings/poc/DF-2644/VERDICT.md (full narrative)"
 ],
 "kernel_refs": [
  "sys/vfs/hammer2/hammer2_flush.c:1334-1338",
  "sys/vfs/hammer2/hammer2_flush.c:1319-1322",
  "sys/vfs/hammer2/hammer2_flush.c:671-679",
  "sys/vfs/hammer2/hammer2_chain.c:998-1009",
  "sys/vfs/hammer2/hammer2_chain.c:147-166"
 ],
 "poc_changes": "Original sketch (vn detach / truncate backing file) was unrunnable: VNIOCDETACH refuses while the mount holds the device (vn.c:464), truncation yields short reads without B_ERROR (vn.c:342-371). Replaced with a sysctl-gated EIO injector inside _hammer2_io_getblk (after DIO setup, exactly where breadnx reports errors); first injector revision returning *diop=NULL was itself an artifact (violated the always-valid-dio contract, crashed in _hammer2_io_putblk) and was corrected to error-injection; volume-gated by volu_size after the guest ROOT hammer2 was also being failed (its boot-time writes panicked via chain.c:3112). Trigger v2 uses metadata-only dirt + bounded arm count.",
 "attempts": 6,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Sat Aug 29 19:59:33 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (kernel A, panic run)",
 "runtime_sec": 6900,
 "guest_dirty": 0,
 "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
 "run_cmd": "sh /root/df2644/run_df2644_inj.sh",
 "code_hash": "see manifest.json artifacts_sha256",
 "notes": "Residual panic chain.c:3112 (KKASSERT parent->error==0 via xop_inode_create_ins / assign_physical) is a separate defect surfaced by the same scenario - recommend filing under hammer2_chain.c. Injector never touches the audited sys/ tree; guest reset with-src after runs.",
 "recommended_fix": "Guard the blockset copy with 'chain->error == 0 && chain->data != NULL' and propagate hammer2_flush()'s return into flush_error so a failed iroot flush also skips volume-header sync (fix.diff)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT kernel B (only delta = fix.diff; in-guest nativekernel)",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "kernel B (stock + DF-2644 fix.diff only) passes the identical EIO-injected sequence with no fault at the site; the designed error handlers operate.",
 "fix_evidence": "fix_build.log / fix_run.log / VERDICT.md"
}