β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0801

Missing NULL check on hammer2_inode_chain in xop_inode_connect β€” latent dead-code NULL deref

Summary

hammer2_xops.c:1488 chain=hammer2_inode_chain(xop->head.ip2,clindex,ALWAYS). :1490 hammer2_chain_modify(chain,...) β€” derefs chain->hmp unconditionally NO NULL check. Every other xop checks NULL (nrename:566-571 create:1132-1138 destroy:1358-1363). LATENT DEAD CODE: hammer2_inode_connect_desc declared hammer2.h:1860 defined hammer2_admin.c:62 but NEVER passed to hammer2_xop_start anywhere in tree. If wired up in future: sparse cluster chain NULL -> hammer2_chain_modify(NULL) panic. Fix: if(chain==NULL) error=EIO goto fail.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0801 Β· 1 files
FileTypeDescriptionSize
manifest.json file 397 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)

Verified recommended fix

Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)

Verdict

Source-confirmed at sys/vfs/hammer2/hammer2_xops.c:1488: missing NULL check on hammer2_inode_chain (latent dead-code NULL deref)