hammer2 bulkfree scan uses kmem_alloc_swapbacked() result unchecked — NULL bitmap reaches bzero(NULL, size) panic in cbinfo_bmap_init; path is unprivileged via the ungated HAMMER2IOC_BULKFREE_SCAN/ASYNC ioctls
| Field | Value |
|---|---|
| ID | DF-2901 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-252 / CWE-476 |
| File | sys/vfs/hammer2/hammer2_bulkfree.c |
| Lines | 569 → 607 → 766 (contract: vm_kern.c:107-135) |
| Area | hammer2 |
| Confidence | likely |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass — vm_kern.c row) |
| Bucket | hammer2 |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
kmem_alloc_swapbacked() prints an error, deallocates the object, and returns NULL when vm_map_find fails (vm_kern.c:127-133). Its only in-tree caller, hammer2_bulkfree_scan (hammer2_bulkfree.c:569), assigns cbinfo.bmap with no NULL check; the scan loop calls cbinfo_bmap_init(&cbinfo, size) (:607) whose first action is bzero(cbinfo->bmap, size) (:766) — kernel NULL-page deref panic. The ioctl path is reachable without privilege because HAMMER2IOC_BULKFREE_SCAN/ASYNC dispatch without the caps_priv_check gate (hammer2_ioctl.c:145-148; gate bypass already catalogued as DF-0815 — context, not re-reported), and bfi->size is caller-supplied (floored 1MB, capped 1/4 RAM at :534-553, no size==0 path). Trigger additionally requires kernel_map KVA exhaustion for a ≤1/4-RAM allocation — not honestly constructible on x86_64. Ceiling: panic (local DoS); no write primitive.
Recommended fix
NULL-check cbinfo.bmap after :569 → kfree dedup + return ENOMEM.
Timeline
- 2026-09-02 Discovered during pass-2 audit of vm_kern.c (GLM 5.3); caller-discipline defect, consequence verified by code trace.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2901 · 10 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 692 B | ↓ raw | |
| VERDICT.md | — | 1.8 KB | ↓ raw | |
| build.sh | — | 55 B | view raw | |
| df2901.c | — | 1.2 KB | view raw | |
| df2901_run.log | — | 110 B | view raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 611 B | view raw | |
| manifest.json | — | 656 B | view raw | |
| run.sh | — | 110 B | view raw | |
| verdict.json | — | 1.9 KB | view raw |
DF-2901 PoC evidence pack
What
hammer2 bulkfree uses kmem_alloc_swapbacked result unchecked; the unpriv ioctl path to the alloc is live-verified.
Build
cc -o df2901 df2901.c
Run
as unpriv: ./df2901 /mnt/h2 (any hammer2 directory)
Expected
unpriv ioctl run: BULKFREE_SCAN ACCEPTED for uid=1001 (sstop=whole volume); NULL form not triggerable
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2901 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: panic | confidence: likely
The NULL path is source-certain: kmem_alloc_swapbacked returns NULL on vm_map_find failure (vm_kern.c:127-133 confirmed); hammer2_bulkfree_scan assigns cbinfo.bmap unchecked and cbinfo_bmap_init bzero()s it first thing. The path TO the alloc is unpriv-reachable and that half REPRODUCED live: an unprivileged user (uid=1001) opened a directory on the ROOT hammer2 filesystem and HAMMER2IOC_BULKFREE_SCAN was accepted and executed (sstop=26826768384 = whole volume; size floor 1MB) - the caps gate is absent exactly as catalogued for DF-0815. The NULL itself requires kernel_map KVA exhaustion for a <=1/4-RAM allocation, not constructible on this guest. Fix (NULL check + kfree dedup + ENOMEM) compiled into the fix-all kernel.
Evidence pointers
df2901_run.log: uid=1001 BULKFREE_SCAN ACCEPTED, sstop=26826768384
Kernel references
PoC changes vs the filing sketch
drove the unpriv ioctl on the root hammer2 mount (mount_hammer2 syntax for the scratch rig failed, root fs used instead)
Fix
recommendation: NULL-check bmap -> kfree(dedup) + ENOMEM
fix status: not_testable
compile-validated in fix-all kernel
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel
Confirmed kernel references
Detail
Evidence (decisive lines)
df2901_run.log: uid=1001 BULKFREE_SCAN ACCEPTED, sstop=26826768384
PoC changes
drove the unpriv ioctl on the root hammer2 mount (mount_hammer2 syntax for the scratch rig failed, root fs used instead)
Verified recommended fix
NULL-check bmap -> kfree(dedup) + ENOMEM
Verdict
The NULL path is source-certain: kmem_alloc_swapbacked returns NULL on vm_map_find failure (vm_kern.c:127-133 confirmed); hammer2_bulkfree_scan assigns cbinfo.bmap unchecked and cbinfo_bmap_init bzero()s it first thing. The path TO the alloc is unpriv-reachable and that half REPRODUCED live: an unprivileged user (uid=1001) opened a directory on the ROOT hammer2 filesystem and HAMMER2IOC_BULKFREE_SCAN was accepted and executed (sstop=26826768384 = whole volume; size floor 1MB) - the caps gate is absent exactly as catalogued for DF-0815. The NULL itself requires kernel_map KVA exhaustion for a <=1/4-RAM allocation, not constructible on this guest. Fix (NULL check + kfree dedup + ENOMEM) compiled into the fix-all kernel.
No comments yet.