Unconditional kernel panic on flush recursion depth limit instead of documented deferral
Summary
hammer2_flush_core panics with panic(hammer2: flush depth limit) when recursion depth reaches HAMMER2_FLUSH_DEPTH_LIMIT(60) even though documentation at :367 :454-456 :1246 describes deferral-list mechanism. No deferral list exists in hammer2_flush_info. Crafted HAMMER2 image with 60+ nested INDIRECT blockrefs triggers unrecoverable panic on first flush recursing into deep subtree. Mounting requires root privilege but auto-mount scenarios or multi-tenant systems that mount user-supplied images affected. Legitimate trees <10 deep for petabyte-scale so only reachable via crafted input. [VERIFIED pass2: reproduced - fresh-boot re-run of the DF-2584 crafted 60-deep INDIRECT chain mount dd sync Fatal double fault; same root as DF-2584; deferral fix A/B SYNC-SURVIVED UMOUNT-OK]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2569 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| craft_deep.py | — | 5.3 KB | view raw | |
| panic.txt | — | 13.0 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
panic.baseline.txt: MOUNT-OK -> dd -> sync -> Fatal double fault; craft_deep.py crafted OK: depth=60
PoC changes
DF-2584 rig reused verbatim (craft_deep.py + build_image.sh flow); image built and crafted fresh this session
Verified recommended fix
implement the documented deferral list instead of panic (DF-2584 fix.diff, in combined fix kernel)
Verdict
hammer2_flush_core panics at the HAMMER2_FLUSH_DEPTH_LIMIT (hammer2_flush.c:583) instead of deferring. Re-verified on a fresh boot with the DF-2584 rig (pristine 2GB TESTFS image + craft_deep.py forging a 60-deep INDIRECT chain): mount OK, dd of /f OK, sync -> panic: double fault (the depth-limit panic fires with the stack already ~60 frames deep; INVARIANTS + deep recursion -> double fault; guest dead in DDB). DF-2569 and DF-2584 are the same root cause; this pack re-runs the rig for DF-2569s own evidence. Trigger needs a crafted image mount (root or vfs.usermount=1) then any write+sync.
No comments yet.