cluster_callback() panics on residual/short cluster I/O instead of propagating an error to components
| Field | Value |
|---|---|
| ID | DF-2727 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-636 / CWE-754 (panic instead of error path) |
| File | sys/kern/vfs_cluster.c |
| Lines | 1127-1131 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
cluster_callback() treats any completion with b_bcount != b_bufsize
(and no B_ERROR) as panic("cluster_callback: unexpected EOF on
cluster"), taking down the system instead of propagating an error to
the component buffers. Today dead code in-tree (nothing decrements a
master cluster bp's b_bcount on completion; device EOF errors out with
B_ERROR; nestiobuf_iodone maps sub-buffer shortfalls to EIO), but a
trap: any current or future driver doing partial completion via
b_resid without B_ERROR (the exact lost-error class the vfs_bio audit
flagged) converts a recoverable short read into an immediate kernel
panic. Reachable solely via a misbehaving storage driver or
root-mounted corrupt metadata; not reachable unprivileged on stock.
Recommended fix
--- a/sys/kern/vfs_cluster.c
+++ b/sys/kern/vfs_cluster.c
@@ -1126,8 +1126,9 @@
if (bp->b_flags & B_ERROR) {
error = bp->b_error;
} else if (bp->b_bcount != bp->b_bufsize) {
- panic("cluster_callback: unexpected EOF on cluster %p!", bio);
+ kprintf("cluster_callback: short transfer on cluster %p\n",
+ bio);
+ error = EIO;
}
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_cluster.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2727 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| README.md | — | 231 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 600 B | view raw | |
| verdict.json | — | 2.0 KB | view raw | |
| fix.diff | — | 456 B | view raw |
DF-2727 evidence pack
- finding: sys/kern/vfs_cluster.c (1127-1131)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2727 - Verification Verdict
Status: reproduced Impact: panic Confidence: certain
Mechanism
cluster_callback treats a residual/short cluster I/O as a panic: else if (bp->b_bcount != bp->b_bufsize) panic(unexpected EOF on cluster) - instead of propagating an error to the component buffers, which the surrounding code is already built to do (the component loop below applies tbp->b_error).
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain panic-on-hardware-fault: a short completion (flaky HBA, truncated device) converts a recoverable I/O error into a full system crash. Not runtime-driven (needs faulty hardware); the fix converts the panic into error propagation exactly like the B_ERROR branch above it.
Threat / reachability
Short/residual cluster I/O panics the kernel instead of failing the writes.
Privilege escalation assessment
n/a (hardening)
Fix
Assign error = EIO instead of panic and let the existing component propagation finish the job.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Assign error = EIO instead of panic and let the existing component propagation finish the job.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain panic-on-hardware-fault: a short completion (flaky HBA, truncated device) converts a recoverable I/O error into a full system crash. Not runtime-driven (needs faulty hardware); the fix converts the panic into error propagation exactly like the B_ERROR branch above it.
No comments yet.