DF-2636 — panic on unhandled on-media objtype in hammer2_igetv

What

hammer2_igetv() (sys/vfs/hammer2/hammer2_inode.c:744-795) switches on ip->meta.type to initialize the vnode. meta.type is copied verbatim from the on-media inode (hammer2_pfsalloc: iroot->meta = ripdata->meta, hammer2_vfsops.c:456). Any on-media value outside {DIRECTORY,REGFILE,SOFTLINK,CDEV,BDEV,FIFO,SOCKET} — e.g. 0 (UNKNOWN), 3, 8, 10 (WHITEOUT), 11..255 — hits:

default:
        panic("hammer2: unhandled objtype %d", ip->meta.type);

An attacker who can craft (or bit-flip, given a checksum-forged image) a hammer2 filesystem image gets an unconditional kernel panic at mount or at the first VFS_ROOT (ls/stat) on the mount. Mounting requires root (or vfs.usermount policies), same trust boundary as the rest of the crafted-image family (DF-0763/DF-0804/DF-0875/DF-2616...).

Reproduce (on the DragonFly QEMU guest, as root)

# forge: flip meta.type (inode block +0x50) of the 'testvol' PFS root
# inode to 0x42, set CHECK_NONE on ancestors, recompute volhdr CRC32Cs
python3 forge_2636.py h2base.img craft2636.img     # host side
scp craft2636.img dfbsd:/root/poc/df2636/          # guest side
sh run.sh

run.sh does: vnconfig + mount_hammer2 -o ro /dev/vn1@testvol /mnt/h2636 + ls -la /mnt/h2636.

Expected

Mount succeeds; the first VFS_ROOT (the lstat inside ls) panics:

panic: hammer2: unhandled objtype 66
hammer2_igetv() at hammer2_igetv+0x42a
hammer2_vfs_root() at hammer2_vfs_root+0xdc
nlookup() at nlookup+0xb9c
kern_stat() ... sys_lstat()

Observed verbatim on the stock INVARIANTS kernel — see panic.txt / run.log.

Fix

Return an error (and mark the vnode VBAD) instead of panicking; see fix.diff.

DF-2636 — VERDICT

Status: reproduced (impact: panic, confidence: certain).

Narrative

The PoC forger (cribbing the proven DF-2616/DF-2624 technique) walks volhdr -> sroot blockset -> PFS inodes, finds the inode named testvol (inode block at image offset 0x1400800 on our base image), flips meta.type (inode block offset +0x50 per hammer2_disk.h hammer2_inode_meta_t) from 1 (DIRECTORY) to 0x42, sets CHECK_NONE on the poison bref and the sroot bref, zeroes mirror_tid on the poison bref so recovery does not recurse, and recomputes the volume-header CRC32Cs.

On the guest (stock INVARIANTS kernel, DragonFly 6.5-DEVELOPMENT #0):

1. mount_hammer2 -o ro /dev/vn1@testvol /mnt/h2636 succeeded (console: hammer2_mount: devstr="/dev/vn1@testvol" ... rdonly=1, HAMMER2: INITIATE SPANs). No type validation exists on the mount path.
2. The first VFS_ROOT — triggered by the lstat inside ls -la — panics exactly at the cited site:

panic: hammer2: unhandled objtype 66
hammer2_igetv() at hammer2_igetv+0x42a
hammer2_vfs_root() at hammer2_vfs_root+0xdc
nlookup() at nlookup+0xb9c
kern_stat() at kern_stat+0x1d
sys_lstat() at sys_lstat+0x57

The ssh session died at the panic (guest froze in ddb) — panic.txt and run.log contain the serial-console capture.

Why this is the cited bug

hammer2_igetv() at sys/vfs/hammer2/hammer2_inode.c:791-793: default: panic("hammer2: unhandled objtype %d", ip->meta.type); ip->meta was populated from media in hammer2_pfsalloc (hammer2_vfsops.c:456, iroot->meta = ripdata->meta) with no validation of type. Valid-but-unhandled on-media values include 0, 3, 8, 10 (WHITEOUT), and 11..255.

Exploit ceiling

Unauthenticated kernel panic (DoS) from a crafted filesystem image at mount/first-access; requires the ability to mount a hammer2 image (root). No memory-corruption primitive — the switch is a straight dispatch on an unvalidated byte, the default branch is a controlled panic.

Fix validation

fix.diff changes the default branch to log, mark the vp VBAD, vx_put it, and return EINVAL; if (vp == NULL) break; guards the tail of the loop. Built with make nativekernel in the guest, installed, rebooted: the same forged image then mounts and ls returns an error instead of panicking (see fix_run.log, fix_build.log). Baseline panic confirmed on the stock kernel in the same session.