hammer2 mount-time volume-size containment check silently skipped when DIOCGPART fails; forged volu_size beyond backing media accepted, short-read media-EOF semantics then serve uninitialized kernel memory as file data

Summary

hammer2_verify_volumes_common() executes the "volume size must not exceed device media size" check only inside the DIOCGPART-success branch (ondisk.c:283-291). vol->size is the raw on-media volu_size taken from the CRC-passing but attacker-forged volume header (:684). Whenever VOP_IOCTL(DIOCGPART) fails — real modes: async slice-probe race via disk_setdiskinfo() for md/dm (dp->d_slice==NULL → ENOIOCTL), drivers whose probe never ran, raw-fallback ENOTTY — a volu_size far beyond the real backing media is accepted silently. Chain reads at data_off ∈ [real_media, forged_volu_size) hit media-EOF semantics that complete WITHOUT B_ERROR — dscheck clamps straddling bios (subr_diskslice.c:275-276), completes at-EOF reads with B_INVAL only (:266-269), vn's short VOP_READ sets no error (vn.c:342-371) — so breadnx/_biowait report success and hammer2_chain_load_data (chain.c:998-1009) consumes the buffer, which is backed by freshly allocated non-zeroed VM pages (bio_page_alloc, vfs_bio.c:4264-4291). With a CHECK_NONE DATA blockref that uninitialized kernel memory is copied to userspace by read(2).

Threat model & preconditions

Crafted-filesystem-image threat model (mount of a malicious image, root or vfs.usermount=1 with an owned device; the DIOCGPART-failure enabler occurs on md/dm probe races or non-probed disks). The identical sink is equally reachable when the backing media shrinks below its registered size after device registration (vn backing truncated — stock-kernel proof). Yields unbounded, repeatable disclosure of recycled kernel/user memory contents (other principals' freed heap/pages) through ordinary read(2), plus silent data fabrication instead of EIO. Demonstrated on the STOCK kernel: 64KB fabricated file data per read, md5 varying per run, a decisive run containing a freed userland process's heap marker on 14 of 16 pages (cross-principal kernel-memory disclosure). Secondary: silent write loss past EOF; composition with DF-0875 (panic when data_off ≥ volu_size; window shifts with forged size — captured live).

Proof of concept

VERIFIED (findings/poc/DF-2663/): injector kernel A accepted size=0x14000000 (320MB) on a 256MB device when the ioctl failed and rejected the identical image when it succeeded; stock kernel accepted the same oversized volu_size on a dm-linear volume (run.log). Stock leak chain: forged DATA bref at 192MB|radix16 with CHECK_NONE + full XXH64/CRC32C cascade recompute → vnconfig registers 256MB+32KB → truncate backing to 192MB → mount ro → cat returns 64KB of stale kernel memory; heap-groom marker captured on 14/16 pages (mk2.bin).

Recommended fix

Fail closed on unknown media size, and never consume short reads — see findings/poc/DF-2663/fix.diff (ondisk.c: refuse mount when DIOCGPART fails; io.c: treat b_resid != 0 || b_bcount != psize as EIO). Validated on kernel B: oversized+ioctl-fail mount rejected fail-closed; the vn-truncation stale read returns EIO with 0 bytes; normal mounts/reads unregressed (md5 match).

References

• DF-0875 (panic on out-of-range data_off), DF-2661/DF-2662 (the EIO-path family), DF-2616 (forging family)

Timeline

• 2026-08-29 Confirmed and expanded from the bulkfree-audit lead; stock-kernel leak reproduced + fix validated same run.