DF-0817 — NULL deref in h2_bulkfree_sync freemap lookup error path

Claim (Medium, CWE-476 NULL Pointer Dereference)

h2_bulkfree_sync() (sys/vfs/hammer2/hammer2_bulkfree.c:1039-1052) calls hammer2_chain_lookup() to find the live freemap leaf for each 4MB chunk in its in-memory bitmap. When the lookup's parent chain has a CRC/I/O error, hammer2_chain_lookup returns NULL with *errorp = parent->error (sys/vfs/hammer2/hammer2_chain.c:2473-2476). Back in h2_bulkfree_sync:

live_chain = hammer2_chain_lookup(&live_parent, &key_dummy,
                                  key, key + HAMMER2_FREEMAP_LEVEL1_MASK,
                                  &error, HAMMER2_LOOKUP_ALWAYS);
if (error) {
    kprintf("hammer2_bulkfree: freemap lookup "
            "error near %016jx, error %s\n",
            (intmax_t)data_off,
            hammer2_error_str(live_chain->error));   /* <-- NULL DEREF */
    break;
}

live_chain is NULL at this point (the lookup returned NULL), but the kprintf dereferences live_chain->error → page fault at fixed virtual address offsetof(hammer2_chain_t, error) = 0x170.

The very next check at :1054 (if (live_chain == NULL)) proves the developer knew NULL was possible — the deref at :1050 is simply the wrong variable: the local error already holds the value the message wants.

Reachability on the audit guest

The bulkfree scan path is the HAMMER2IOC_BULKFREE_SCAN ioctl. Per DF-0815 (also verified on this guest), hammer2_ioctl() computes the privilege gate once but does not guard the BULKFREE_SCAN case with the usual if (error == 0) — so an unprivileged user holding any fd on a hammer2 mount reaches hammer2_ioctl_bulkfree_scan() directly.

Triggering the NULL deref additionally requires the live freemap lookup to fail — i.e. a corrupted FREEMAP_NODE block on the media. This is supplied by a crafted hammer2 image (or natural media corruption). The setup is a normal admin operation (mount an fs image), the attack is the unprivileged BULKFREE_SCAN ioctl that consumes it.

Effect: kernel panic / local DoS (fixed-offset NULL deref — pure DoS, no escalation chain).

Build / Run

Root-side setup (creates + corrupts the image, mounts it RO at /mnt/h2t):

ssh dfbsd 'chmod +x /root/setup_image.sh && /bin/sh /root/setup_image.sh'

Unprivileged trigger (as maxx, uid 1001):

cc -o df0817 df0817.c
./df0817 /mnt/h2t

Expected output

• Bug present (unpatched #0): the guest PANICS before the ioctl returns. Serial log shows: chain 0000000000XX000f.05 meth=50 CHECK FAIL freemap.icrc XXXXXXXX icrc32 YYYYYYYY (32768) Fatal trap 12: page fault while in kernel mode fault virtual address = 0x170 Stopped at hammer2_bulkfree_pass+0xdbe: movl 0x170(%rax),%edi (h2_bulkfree_sync is inlined into hammer2_bulkfree_pass by gcc, so the fault address is the inlined call site, not a separate symbol.)
• Fixed (patched #1): the ioctl returns cleanly with errno=33 (EDOM) (which is hammer2_error_to_errno(HAMMER2_ERROR_CHECK)); dmesg shows the now-correct kprintf message hammer2_bulkfree: freemap lookup error near ..., error Check Error and the bulkfree scan completes with a CRC-error warning. No panic.

Files

• df0817.c — unprivileged trigger (issues HAMMER2IOC_BULKFREE_SCAN)
• setup_image.sh — root-side image setup (newfs + populate + corrupt + mount RO)
• build.sh / run.sh — exact repro
• panic.txt — panic signature (proof of the NULL deref)
• baseline_run.log — panic signature from the unpatched-#0 baseline run
• baseline_boot.log — full serial log around the baseline panic
• fix_run.log — dmesg after the PoC on the patched-#1 kernel (no panic)
• fix_build.log — full single-fix kernel build output (rc=0)
• fix_kernel_info.txt — patched kernel kern.version + sha256
• fix.diff — git-apply-able one-line fix (use local error, not live_chain->error)
• env.txt — guest environment
• VERDICT.md — full narrative
• manifest.json — artifact catalog

DF-0817 — VERDICT

Verdict: REPRODUCED → FIX VALIDATED

NULL pointer dereference in h2_bulkfree_sync() freemap lookup error path. CWE-476. Medium severity (local DoS via fixed-offset NULL deref).

The bug is real, the trigger is reachable by an unprivileged user via the DF-0815 privilege bypass on BULKFREE_SCAN, and the one-line fix is verified to close it cleanly (panic on baseline #0 → clean EDOM return on patched #1).

Mechanism (trigger → primitive → effect)

h2_bulkfree_sync() walks the in-memory bulkfree bitmap and, for each 4MB chunk with activity, looks up the corresponding live freemap leaf:

/* sys/vfs/hammer2/hammer2_bulkfree.c:1039 */
live_chain = hammer2_chain_lookup(&live_parent, &key_dummy,
                                  key, key + HAMMER2_FREEMAP_LEVEL1_MASK,
                                  &error, HAMMER2_LOOKUP_ALWAYS);
if (error) {                                            /* :1046 */
    kprintf("hammer2_bulkfree: freemap lookup "
            "error near %016jx, error %s\n",
            (intmax_t)data_off,
            hammer2_error_str(live_chain->error));      /* :1050  <-- BUG */
    break;
}

hammer2_chain_lookup descends the freemap tree from live_parent (the hmp->fchain volume-freemap root) down through any FREEMAP_NODE levels to the FREEMAP_LEAF. The descent is in sys/vfs/hammer2/hammer2_chain.c:

/* sys/vfs/hammer2/hammer2_chain.c:2473-2476 */
if (parent->error) {
    *errorp = parent->error;
    return NULL;
}

When ANY FREEMAP_NODE in the descent path has its on-disk data fail the check.freemap.icrc32 CRC (hammer2_chain.c:1070-1072, which sets chain->error = HAMMER2_ERROR_CHECK), the lookup takes this branch on the next iteration: parent is the corrupted FREEMAP_NODE, parent->error is set, the function returns NULL with *errorp populated. error is now non-zero AND live_chain is NULL — exactly the precondition for the deref at :1050 to fault.

The fault address is fixed: live_chain == NULL, so live_chain->error is the read at &NULL + offsetof(hammer2_chain_t, error) = 0x170 (verified against struct hammer2_chain in sys/vfs/hammer2/hammer2.h:324-342; the error field sits at byte offset 0x170 after lock, core, rbnode, bref, parent, hmp, pmp, diolk, dio, data, bytes, flags, refs, lockcnt).

live_chain == NULL is explicitly contemplated by the very next statement:

/* sys/vfs/hammer2/hammer2_bulkfree.c:1054 */
if (live_chain == NULL) {
    /*
     * XXX if we implement a full recovery mode we need
     * to create/recreate missing freemap chains ...
     */

so the missing guard at :1050 is plainly an oversight — the kprintf just uses the wrong variable. The local error already holds exactly the value the message wants to print.

Trigger path on the audit guest

• HAMMER2IOC_BULKFREE_SCAN reaches hammer2_ioctl_bulkfree_scan() (hammer2_ioctl.c:1088) which calls hammer2_bulkfree_pass() (hammer2_bulkfree.c:513) which calls h2_bulkfree_sync() (:702, inlined into the caller by gcc).
• Per DF-0815, hammer2_ioctl() does NOT guard the BULKFREE_SCAN case with if (error == 0) after the caps_priv_check(cred, SYSCAP_NOVFS_IOCTL) privilege check at hammer2_ioctl.c:83. An unprivileged user holding any fd on a hammer2 mount (the audit guest's root fs is hammer2) reaches the handler directly.

Effect

Fixed-virtual-address NULL read from kernel mode → fatal trap 12, page fault, kernel panic, guest down. Pure DoS — there is no write primitive, no UAF, no controlled content, so there is no escalation chain. (A fixed-offset kernel NULL read does not give an attacker a controlled write or a pointer-leak on this guest, so per Phase 6 of the procedure this is documented as DoS and there is no exploit.c.)

Reproduction evidence — unpatched #0 baseline

Run as unprivileged uid 1001 (maxx) against a crafted hammer2 image (8 GB image, freemap populated with 6 GB of incompressible data so the freemap tree has a FREEMAP_NODE level, then the FREEMAP_NODE block's CRC broken on disk by flipping 4 bytes inside it; mounted read-only at /mnt/h2t):

$ ./df0817 /mnt/h2t
[*] uid=1001 euid=1001  opening '/mnt/h2t' on hammer2 mount
[*] issuing HAMMER2IOC_BULKFREE_SCAN
<guest panics here; ssh dies>

Serial log (dfbsd-qemu/boot.log):

hammer2: bulkfree buf=1M
hammer2: pass 0000000000000000-0000000200000000 (all media)
hammer2_bulkfree: Scanning DATA
hammer2_bulkfree: Scanning LOCAL
bulkfree lastdrop 1 0
hammer2_bulkfree - range 0000000014400c00-0000000200000000
chain 000000000020000f.05 meth=50 CHECK FAIL                          <- CRC fail on FREEMAP_NODE
freemap.icrc 276fe33c icrc32 1dd2a150 (32768)
dio 0xfffff80119548500 buf 0000000000200000,65536 bdata 0xfffff80055a76000/0xfffff80055a76000
Fatal user address access from kernel mode from df0817 at ffffffff8096410e
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x170                                      <- NULL + offsetof(hammer2_chain_t, error)
Stopped at hammer2_bulkfree_pass+0xdbe:  movl 0x170(%rax),%edi       <- reads *(NULL + 0x170) = live_chain->error
db>

The fault address 0x170 is the smoking gun — it is exactly offsetof(hammer2_chain_t, error), i.e. live_chain->error with live_chain == NULL.

Why this is NOT memory corruption — no escalation chain

The primitive is a fixed-virtual-address NULL read (the kernel reads *(NULL + 0x170)), which on this guest immediately page-faults. There is no write, no UAF re-claim, no controlled content, no freed-object reuse, and the faulting instruction is a movl (load) not a store. Nothing the attacker does between the trigger and the fault can convert this into a controlled write or pointer forge — the read is the entire primitive, and it always misses (NULL page is unmapped, page not present). Per Phase 6 this is a "valid hard blocker: read-only primitive" — no escalation chain exists, by construction. Documented as DoS.

PoC changes

The seeded PoC folder did not exist. Authored fresh: - df0817.c — unprivileged trigger (issues HAMMER2IOC_BULKFREE_SCAN via the DF-0815 privilege bypass on a hammer2 mount). - setup_image.sh — root-side image preparation: newfs_hammer2 on an 8 GB sparse image, populate with 6 GB of /dev/urandom data (NOT /dev/zero — hammer2's default lz4 compression collapses zeros and the freemap tree ends up with no FREEMAP_NODE level, making the bug unreachable), unmount, corrupt the FREEMAP_NODE block's data CRC in every rotation slot of every 2GB zone (the active slot is whichever the last sync picked), remount read-only. - Key correctness fixes during iteration: 1. Image must use random data, not zeros. Zeros compress to ~0 bytes; the freemap never grows a FREEMAP_NODE level and the bug is unreachable. 2. Image must be >4 GB. The FREEMAP root's blockset has only 4 blockref slots (HAMMER2_SET_COUNT=4); each direct FREEMAP_LEAF covers 1 GB. <=4 GB of allocations fits in direct leaves under the FREEMAP root with no FREEMAP_NODE indirection, and the bug's parent->error path is unreachable. 3. The FREEMAP_NODE block location is not fixed. hammer2 rotates the freemap on every modifying sync across 8 rotation slots per 2GB zone (hammer2_freemap_reserve, hammer2_freemap.c:97-110), so the "current" FREEMAP_NODE block's device offset varies between runs. The setup script corrupts byte 0x100 of all 8 rotation slots of all zones that exist within the 8GB image — guaranteeing the active FREEMAP_NODE block is hit regardless of which rotation the kernel picked. 4. DragonFly /bin/sh printf does NOT understand \xAA hex escapes (it emits the literal characters "xaa"). The setup script uses octal \252\253\254\255 instead.

Fix (authored, validated)

fix.diff — one-line change at hammer2_bulkfree.c:1050:

-                   hammer2_error_str(live_chain->error));
+                   hammer2_error_str(error));

Use the local error variable (already populated by the lookup) instead of dereferencing the NULL live_chain. This matches what the developer clearly intended (the if (live_chain == NULL) check at :1054 demonstrates they expected NULL), and matches the established pattern in the sibling hammer2_freemap_try_alloc error kprintf at hammer2_freemap.c:349-351 which uses hammer2_error_str(chain->error) only after explicitly checking chain != NULL && chain->error at :345.

(The line at :1073 — hammer2_error_str(live_chain->error) — is left untouched; it is guarded by the if (live_chain->error) check at :1069, so live_chain is guaranteed non-NULL there.)

Fix validation (Phase 8) — VALIDATED

Clean before/after. Both runs used the same crafted image and the same df0817 binary — only the kernel changed. On the patched kernel the bulkfree scan still detects and reports the CRC error (so the file- system-defect handling is preserved), it just no longer crashes on it. Deterministic across 2 runs.

Files

• df0817.c — trigger (unprivileged BULKFREE_SCAN via DF-0815 bypass)
• setup_image.sh — root-side image setup
• build.sh / run.sh — exact repro
• panic.txt — panic signature (proof)
• baseline_run.log / baseline_boot.log — full unpatched-#0 run
• fix_run.log / fix_kernel_info.txt — patched-#1 run + kernel identity
• fix_build.log — full single-fix kernel build (rc=0)
• fix.diff — git-apply-able fix
• env.txt — guest environment
• manifest.json — artifact catalog