NULL parent->data dereference in hammer2_bulkfree_scan's PFSROOT kprintfs when a PFS-root chain fails to load with a non-CHECK error

Summary

hammer2_bulkfree_scan locks each recursable chain with RESOLVE_ALWAYS and then guards only HAMMER2_ERROR_CHECK (bulkfree.c:135) before unconditionally dereferencing parent->data->ipdata.filename for PFSROOT inodes in its two kprintf()s (:143-147 and :393-398). hammer2_chain_load_data leaves chain->data == NULL with error = EIO when bread() fails (chain.c:1003-1008), and hammer2_chain_scan itself refuses such parents (chain.c:2876-2879) — the bulkfree prints are the sole unguarded consumers. A PFS-root inode on unreadable media (real bad sector) therefore turns a routine bulkfree into a kernel page fault (va ~0x100) instead of an error report.

Threat model & preconditions

Kernel panic (availability) whenever a bulkfree pass — run by root via hammer2(8) or by any local user via the ungated HAMMER2IOC_BULKFREE_SCAN (DF-0815) — encounters an unreadable PFS-root inode on failing media. Robustness defect rather than a forged-image corruption primitive (mount-time volu_size <= media_size checks close the forged route).

Proof of concept

Guest verification reached the exact crash precondition (unprivileged ungated ioctl driving the scan into chain_lock → load_data → _hammer2_io_bread on a forged PFSROOT chain; panic_getvolume.txt backtrace), but the final EIO link could not be materialized: hammer2 enforces volu_size ≤ media_size at mount (ondisk.c:283-290) so every in-window read succeeds on vn media, and out-of-volume offsets panic earlier in hammer2_get_volume (already filed as DF-0875). Honest classification: not_reproduced; the defect is line-proven and the reachability demonstrated; triggering requires real unreadable media. Evidence: findings/poc/DF-2649/.

Recommended fix

--- a/sys/vfs/hammer2/hammer2_bulkfree.c
+++ b/sys/vfs/hammer2/hammer2_bulkfree.c
@@ -138,6 +138,19 @@
     }

     /*
+    * DF-2649: a pure I/O error while resolving the parent leaves
+    * chain->data == NULL with a non-CHECK error (and a zero data_off
+    * can leave it NULL with no error at all).  We can neither
+    * traverse nor print such a chain - its block table was never
+    * read - so skip it instead of dereferencing parent->data in the
+    * PFSROOT kprintf()s below.
+    */
+    if (parent->data == NULL) {
+        error = parent->error | HAMMER2_ERROR_EIO;
+        goto done;
+    }
+
+    /*
     * Report which PFS is being scanned
     */

Validated to compile/boot in the rebuilt kernel (no regression); behavior not observable in-guest (fix_status: not_testable).

References

• chain.c:1003-1008 (error state), chain.c:2876-2879 (the working guard in chain_scan), DF-0875 (the earlier get_volume panic)

Timeline

• 2026-08-29 Discovered during pass-2 audit of hammer2_bulkfree.c (GLM 5.3).