DF-0867 — PoC: kernel panic via unvalidated rec_type in mirror_write_rec

Claim (finding)

The HAMMER mirror-write record path accepts an on-disk rec_type without validating it against the valid record-type set. A crafted mirror stream whose record has data_len > 0 and an unhandled rec_type reaches hammer_alloc_data() (sys/vfs/hammer/hammer_ondisk.c:1634), whose switch() only handles INODE/DIRENTRY/EXT/FIX/PFS/SNAPSHOT/CONFIG/DATA/DB; the default case (:1669) calls hpanic("rec_type %04x unknown", rec_type) → kernel panic.

Reachability / threat model

• HAMMERIOC_MIRROR_WRITE ioctl is guarded by caps_priv_check(cred, SYSCAP_NOVFS_IOCTL) (hammer_ioctl.c:72) — root locally.
• Realistic remote vector: a malicious mirror source feeds a crafted mirror stream to a victim running hammer mirror-write on its HAMMER slave. The victim kernel parses the attacker-controlled stream and panics. No credentials on the target needed beyond what mirror-write already grants (a configured mirror relationship).
• This is a memory-safe DoS (the unhandled case panics before any write occurs; there is no write primitive). No escalation path.

How to reproduce

# as root on the DragonFly guest:
./build.sh            # cc -o trigger trigger.c
./run.sh              # creates a HAMMER image, mounts it, fires the ioctl

Expected on the unpatched kernel: guest dies; dfbsd-qemu/boot.log shows

panic: rec_type 0002 unknown

(with Stopped at hammer_alloc_data+... / db>).

Expected on a fixed kernel: trigger returns cleanly, prints ioctl returned (no panic): head.error=... (EINVAL), guest stays up.

Files

• trigger.c — minimal mirror-write mrec with bad rec_type
• setup.sh — create+newfs+mount a HAMMER image (root)
• build.sh / run.sh
• fix.diff — validate rec_type in hammer_ioc_mirror_write_rec

DF-0867 — VERDICT

Verdict

REPRODUCED — kernel panic (DoS). Fix VALIDATED on a single-fix kernel.

Mechanism (trigger → primitive → effect)

The HAMMER mirror-write path accepts an attacker-controlled on-disk rec_type without validating it. The full chain, every hop cited:

1. HAMMERIOC_MIRROR_WRITE ioctl reaches hammer_ioctl() (sys/vfs/hammer/hammer_ioctl.c:72 — guarded by caps_priv_check(cred, SYSCAP_NOVFS_IOCTL), i.e. root locally; :169 dispatches HAMMERIOC_MIRROR_WRITE).
2. hammer_ioc_mirror_write() (sys/vfs/hammer/hammer_mirror.c:330) reads mirror records from the user buffer, checks only signature (:418) and rec_size bounds (:422-427), then dispatches HAMMER_MREC_TYPE_REC to hammer_ioc_mirror_write_rec() (:436-440).
3. hammer_ioc_mirror_write_rec() (:566) validates data_len (:575-579) but never mrec->leaf.base.rec_type. When the record does not exist (B-tree lookup → ENOENT, :627) and create_tid is in window (:628), it calls hammer_create_at_cursor() (:629).
4. hammer_create_at_cursor() (sys/vfs/hammer/hammer_object.c:2274) calls hammer_alloc_data(trans, leaf->data_len, leaf->base.rec_type, …) at :2299 whenever leaf->data_len != 0 (:2298) — before the copyin/CRC checks at :2312-2314.
5. hammer_alloc_data() (sys/vfs/hammer/hammer_ondisk.c:1634) has a switch(rec_type) (:1646) that handles only INODE/DIRENTRY/EXT/FIX/PFS/SNAPSHOT/CONFIG/DATA/DB. The default case (:1669) does hpanic("rec_type %04x unknown", rec_type), which expands to panic().

A single mirror record with data_len>0 and an unhandled rec_type (e.g. 0x0002, used here) reaches step 5 and panics the kernel. Confirmed serial-log signature:

panic: hammer_alloc_data: rec_type 0002 unknown
hammer_alloc_data() at hammer_alloc_data+0x184
hammer_create_at_cursor() at hammer_create_at_cursor+0xf0
hammer_ioc_mirror_write() at hammer_ioc_mirror_write+0x3f8
hammer_ioctl() at hammer_ioctl+0xebe
hammer_vop_ioctl() at hammer_vop_ioctl+0x48

Exploit chain / impact

This is a memory-safe DoS — hammer_alloc_data()'s default branch is a panic, not a write. There is no memory-corruption primitive, so there is no escalation chain to develop (exploit_chain: none, non-corruption class). Impact = dos.

Threat model / reachability: - Local: requires SYSCAP_NOVFS_IOCTL (root or jail-with-cap), so a local unprivileged user cannot reach it directly. - Remote (realistic): a malicious HAMMER mirror source feeds a crafted mirror stream to a victim that runs hammer mirror-write on its slave. The victim kernel parses the attacker-controlled stream (copyin of the mrec at hammer_mirror.c:415) and panics — a remote, pre-auth (within the configured mirror relationship) kernel DoS of the mirror target.

PoC

trigger.c issues HAMMERIOC_MIRROR_WRITE with one HAMMER_MREC_TYPE_REC mrec whose leaf.base.rec_type = 0x0002 and leaf.data_len = 16. setup.sh creates a 2 GiB HAMMER image (newfs_hammer -f), vnconfigs a free vn*, mount_hammers it, and touches a target. run.sh ties it together.

PoC changes from the seed

The finding shipped no seed PoC (only poc_path was set). This runner authored the complete evidence pack from scratch: trigger.c, setup.sh, build.sh, run.sh, README.md, fix.diff, and all logs. The struct layouts and constants were taken from the audited sys/vfs/hammer/hammer_*.h and the installed /usr/include/vfs/hammer/ headers (the guest has them).

Fix (fix.diff)

Validate rec_type at the mirror trust boundary in hammer_ioc_mirror_write_rec() (right after the existing data_len validation, hammer_mirror.c:579): a switch allows only the nine types hammer_alloc_data() can handle and returns EINVAL for anything else. Minimal, targeted at the root cause (untrusted rec_type entering the allocator). Supersedes/matches the finding's "validate rec_type in mirror_write_rec" recommendation — same intent, implemented as a concrete patch.

Fix validation (Phase 8)

• Baseline (#0, unpatched): trigger → panic: hammer_alloc_data: rec_type 0002 unknown, guest dies. (fix_baseline_reproduced = 1.)
• **Single-fix kernel (#1, only this diff applied, built make -j6 nativekernel, installed over /boot/kernel/kernel): sysctl kern.version ⇒ 6.5-DEVELOPMENT #1: Sat Jul 11 18:29:09 UTC 2026; same trigger → ioctl returned (no panic): head.error=22 (EINVAL), guest stays up. Deterministic across 2 runs. (fix_patched_reproduced = 0; fix_status = fixed.)

Kernel refs (confirmed during verification)

• sys/vfs/hammer/hammer_ioctl.c:72 — SYSCAP_NOVFS_IOCTL privilege gate
• sys/vfs/hammer/hammer_ioctl.c:169 — HAMMERIOC_MIRROR_WRITE dispatch
• sys/vfs/hammer/hammer_mirror.c:566 — hammer_ioc_mirror_write_rec
• sys/vfs/hammer/hammer_mirror.c:575-579 — data_len validated, rec_type not
• sys/vfs/hammer/hammer_mirror.c:629 — calls hammer_create_at_cursor
• sys/vfs/hammer/hammer_object.c:2299 — hammer_alloc_data(..., leaf->base.rec_type, ...)
• sys/vfs/hammer/hammer_ondisk.c:1646-1672 — switch(rec_type), only 9 types handled
• sys/vfs/hammer/hammer_ondisk.c:1669 — hpanic("rec_type %04x unknown") → panic