handle_workitem_freeblocks: indir_trunc errors silently swallowed — '== 0' dead store makes allerror unreachable, I/O errors during indirect-block deallocation unreported
| Field | Value |
|---|---|
| ID | DF-2991 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-754 |
| File | sys/vfs/ufs/ffs_softdep.c |
| Lines | 2168-2170, 2188 |
| Area | vfs/ufs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
In handle_workitem_freeblocks, the loop over indirect blocks assigns 'if ((error = indir_trunc(...)) == 0) allerror = error;' — error is only assigned into allerror when it is 0, so allerror can never become non-zero and the DIAGNOSTIC error report at :2188-2189 is dead code. Real read/deallocation failures of indirect blocks are silently dropped (frees of the containing indirect blocks still proceed), so a filesystem can go inconsistent after transient I/O errors with no kernel indication, unlike ffs_truncate which propagates indir-truncation errors. Inverted comparison (should be '!= 0'); one-character fix. Requires an underlying device I/O error during background deallocation — robustness/consistency defect, not attacker-controllable.
Timeline
- 2026-09-02 Discovered during pass-2 audit of ffs_softdep.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2991 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 554 B | ↓ raw | |
| VERDICT.md | — | 1.5 KB | ↓ raw | |
| env.txt | — | 401 B | view raw | |
| fix.diff | — | 845 B | view raw | |
| manifest.json | — | 444 B | view raw | |
| verdict.json | — | 1.5 KB | view raw |
DF-2991 PoC evidence pack
What
handle_workitem_freeblocks: == 0 dead store makes indir_trunc error propagation impossible.
Build
(none)
Run
(none)
Expected
static dead-store proof (allerror unreachable)
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 All logs are full untrimmed captures unless noted. fix.diff is the git-apply-able verified fix (authored after verification; never applied to the audit tree).
DF-2991 - verification verdict
Status: not_reproduced | reproduced: 0 | impact: corruption | confidence: certain
Dead store statically certain, runtime manifestation not injectable. In handle_workitem_freeblocks the loop reads if ((error = indir_trunc(...)) == 0) allerror = error; - allerror is only ever assigned 0, so a non-zero indir_trunc failure can never propagate and the DIAGNOSTIC softdep_error report is unreachable dead code (ffs_softdep.c:2168-2189). Triggering requires a real device I/O error during background indirect-block deallocation, which this guest cannot inject; the one-character fix (!= 0) is compiled into the fix-all kernel.
Evidence pointers
source: ffs_softdep.c:2168-2169 assignment only when == 0; :2188-2189 dead report
Kernel references
PoC changes vs the filing sketch
no fault injection available; static proof
Fix
recommendation: one-character fix: != 0
fix status: not_testable
compile-validated in fix-all kernel
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:04 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablecompile-validated in fix-all kernel
Confirmed kernel references
Detail
Evidence (decisive lines)
source: ffs_softdep.c:2168-2169 assignment only when == 0; :2188-2189 dead report
PoC changes
no fault injection available; static proof
Verified recommended fix
one-character fix: != 0
Verdict
Dead store statically certain, runtime manifestation not injectable. In handle_workitem_freeblocks the loop reads if ((error = indir_trunc(...)) == 0) allerror = error; - allerror is only ever assigned 0, so a non-zero indir_trunc failure can never propagate and the DIAGNOSTIC softdep_error report is unreachable dead code (ffs_softdep.c:2168-2189). Triggering requires a real device I/O error during background indirect-block deallocation, which this guest cannot inject; the one-character fix (!= 0) is compiled into the fix-all kernel.
No comments yet.