DF-3140 — error-path buffer leaks in hpfs_addextent (:498-500) and hpfs_truncatealblk (:798-801): deterministic kernel panic via leaked-buffer re-lock; B_BUSY buffer accumulation

Build

./build.sh      # crafts the (sparse, ~229 MB) df3140.img, gzip-pushes
                # it to the guest, compiles poc + mount_rw

Run

./run.sh        # mounts RW; trunc variant: 2x ftruncate as uid 1001
                # (2nd hangs), root attempts kill -9

Expected / observed

• trunc variant (file TRUN): DF3140 trunc: 1st ftruncate(512)... rc=-1 (error returned; hpfs_breadstruct: MAGIC DOESN'T MATCH printed — the sibling read at alsubr.c:798 fails and the function returns WITHOUT brelse(bp): the child AlSec buffer stays LK_EXCLUSIVE-locked) DF3140 trunc: 2nd ftruncate(512)... (never returns) => panic: lockmgr: locking against myself, backtrace: lockmgr_exclusive <- getblk <- breadnx <- hpfs_breadstruct <- hpfs_truncatealblk (full text in panic.txt / run.log) Unprivileged ftruncate x2 = deterministic kernel panic.
• add variant (file ADDL): every failing pwrite leaks one held 512-byte buffer + one bitmap sector (addextent's children-reparenting loop returns without releasing nbp at :498-500); accumulation exhausts the buffer cache (getblk blocks forever) — by construction; not run to exhaustion (guest was spent on the stronger trunc-panic evidence).

Root causes: missing brelse(bp) / brelse(nbp) on the two error returns cited above (contrast the correct handling at alsubr.c:693-697).

DF-3140 VERDICT — REPRODUCED (deterministic kernel panic from unprivileged double-ftruncate; error-path B_BUSY buffer leak)

Observed (run.log + panic.txt)

Crafted image, RW mount, uid 1001 (maxx):

1. ftruncate(fd, 512) #1 on file TRUN returns -1 (error). Console: hpfs_breadstruct: MAGIC DOESN'T MATCH (0x00000000 != 0x37e40aae) — the sibling-AlSec read at sys/vfs/hpfs/hpfs_alsubr.c:798-801 (an[0] -> sector without AS_MAGIC) failed and the error return at :801 left bp (the current child AlSec buffer, LK_EXCLUSIVE from getblk/bread) permanently locked — the leak.
2. ftruncate(fd, 512) #2 (same fd/thread) re-enters hpfs_truncatealblk, breads the same child AlSec -> getblk -> lockmgr_exclusive on the buffer already held by this thread: panic: lockmgr: locking against myself lockmgr_exclusive() at lockmgr_exclusive+0x3e0 getblk() at getblk+0xe1 breadnx() at breadnx+0x284 hpfs_breadstruct() at hpfs_breadstruct+0x45 hpfs_truncatealblk() at hpfs_truncatealblk+0xf2 Guest dies at db>. Deterministic (2 syscalls).

Secondary consequence (by construction, not run to exhaustion)

The addextent twin (alsubr.c:498-500: children-reparenting loop returns without brelse(nbp) after hpfs_alblk2alsec) leaks one held 512-byte buffer per failing pwrite (plus its bitmap sector). Repeated failing pwrites accumulate B_BUSY buffers until getblk blocks forever — buffer-cache exhaustion / unkillable-writer DoS. Not executed at scale on the guest (budget spent on the stronger deterministic panic).

Fix validation

fix.diff (shared, DF-3137 pack) adds the two missing brelse() calls. Patched kernel: 1st ftruncate still returns the original error, 2nd ftruncate returns cleanly (no hang, no panic — the buffer is properly released between calls). See fix_run.log.

Verdict

REPRODUCED — impact panic (deterministic, unprivileged), plus accumulation DoS by construction. Kernel refs: sys/vfs/hpfs/hpfs_alsubr.c:790-801 (leak #2 + concat path), :490-509 (leak #1), :693-697 (the correct pattern for contrast), sys/kern/vfs_bio.c:899-945 + sys/sys/buf2.h:347 (bread hands out a locked buffer the caller must release).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.