NULL-pointer dereference in hammer2_freemap_adjust() when the freemap leaf is absent — mount-time panic from crafted image

Summary

hammer2_freemap_adjust() tests chain->error at freemap.c:1021 before ruling out chain == NULL. The NULL guard at :1016 (chain == NULL && how != DORECOVER) is structurally dead because how is KKASSERTed == HAMMER2_FREEMAP_DORECOVER at :972 (the only live mode; the free paths are #if 0). When the on-disk freemap topology has no FREEMAP_LEAF covering the bref's 1GB region (crafted image with blanked freemap_blockset), the mount-time recovery scan (vfsops.c:2234/:2325) calls adjust(DORECOVER), the lookup returns NULL, and the kernel page-faults reading NULL+0x170 (offsetof(hammer2_chain_t, error)). INVARIANTS-independent — no assertion is involved.

Threat model & preconditions

Crafted hammer2 image (blanked volume-header freemap_blockset + mirror_tids above freemap_tid); any mount (root, vfs.usermount=1, auto-mounter) takes a deterministic fatal trap 12 during mount. Ceiling is DoS (page 0 unmapped on amd64). The dedup re-registration path (chain.c:1627) reaches the same deref.

Proof of concept

VERIFIED on the guest (findings/poc/DF-2651/): forge_2651.py (blanks freemap_blockset, bumps sroot+testvol bref mirror_tids 0x11→0x20, CHECK_NONE ancestors, volhdr CRC32C recompute) → vnconfig + mount → Fatal trap 12 ... fault virtual address = 0x170 ... Stopped at hammer2_freemap_adjust+0xce: movl 0x170(%rax),%r9d. Baseline panic on stock #0; patched kernel #1 mounts the same image cleanly. No uid=0 route — NULL+const read on unmapped page 0.

Recommended fix

--- a/sys/vfs/hammer2/hammer2_freemap.c
+++ b/sys/vfs/hammer2/hammer2_freemap.c
@@ -1013,13 +1013,17 @@
    /*
     * Stop early if we are trying to free something but no leaf exists.
     */
-   if (chain == NULL && how != HAMMER2_FREEMAP_DORECOVER) {
-       kprintf("hammer2_freemap_adjust: %016jx: no chain\n",
-           (intmax_t)bref->data_off);
-       goto done;
-   }
-   if (chain->error) {
+   /*
+    * DF-2651: chain can legitimately be NULL here (missing freemap
+    * leaf); only DORECOVER creates it further down.
+    */
+   if (chain == NULL) {
+       if (how != HAMMER2_FREEMAP_DORECOVER) {
+           kprintf("hammer2_freemap_adjust: %016jx: no chain\n",
+               (intmax_t)bref->data_off);
+           goto done;
+       }
+   } else if (chain->error) {
        kprintf("hammer2_freemap_adjust: %016jx: error %s\n",

(only test chain->error after ruling out NULL so DORECOVER falls through to the existing chain_create at :1037)

Timeline

• 2026-08-29 Discovered during pass-2 audit of hammer2_freemap.c (GLM 5.3); verified reproduced + fix validated same run.