Missing NULL check on hammer2_inode_chain in xop_inode_connect β latent dead-code NULL deref
Summary
hammer2_xops.c:1488 chain=hammer2_inode_chain(xop->head.ip2,clindex,ALWAYS). :1490 hammer2_chain_modify(chain,...) β derefs chain->hmp unconditionally NO NULL check. Every other xop checks NULL (nrename:566-571 create:1132-1138 destroy:1358-1363). LATENT DEAD CODE: hammer2_inode_connect_desc declared hammer2.h:1860 defined hammer2_admin.c:62 but NEVER passed to hammer2_xop_start anywhere in tree. If wired up in future: sparse cluster chain NULL -> hammer2_chain_modify(NULL) panic. Fix: if(chain==NULL) error=EIO goto fail.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0801 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 397 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)
Verified recommended fix
Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)
Verdict
Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)
No comments yet.