DF-3175 — ftruncate() on special-file (FIFO/device) inodes frees their

i_db[] overlay as disk blocks → kernel panic or silent cross-file block free

Verdict

REPRODUCED on the stock GENERIC kernel (6.5-DEVELOPMENT #0, INVARIANTS ON), both variants, from an unprivileged trigger (user maxx, uid 1000) on a root-mounted crafted ext2 image:

1. panic variant (targetA) — deterministic kernel panic: panic: ext2_blkfree: freeing free block 499, fs=/mnt/df3175 ext2_blkfree() at ext2_blkfree+0x28d ext2_truncate() at ext2_truncate+0x3aa ext2_setattr() at ext2_setattr+0x21a vop_setattr() at vop_setattr+0x54 kern_ftruncate() at kern_ftruncate+0x190 Guest dies in DDB (vm.sh status → down). See panic.txt.

2. silent-free variant (targetB) — no panic, ftruncate returns 0: [trigger] pre : f_bfree=483 f_blocks=492 [trigger] ftruncate returned rc=0 errno=0 (success) [trigger] post: f_bfree=484 (delta 1) [trigger] SILENT FREE CONFIRMED: 1 block(s) freed ... On-disk proof after unmount (host-side debugfs): Block 26 not in use <- bitmap says FREE victim BLOCKS: (0):26 <- victim still references block 26 i.e. a live data block of another file was freed and is now allocatable to any future file while victim still reads/writes it — cross-file block aliasing (confidentiality/integrity break inside the fs, silent, no kernel message).

Root cause (line-accurate)

• sys/kern/vfs_syscalls.c:4105 — kern_ftruncate rejects only VDIR.
• sys/vfs/ext2fs/ext2_vnops.c:330-341 — ext2_setattr's va_size switch: case VLNK/VREG: … break; default: break; → VCHR/VBLK/VFIFO/VSOCK fall through to ext2_truncate(). FreeBSD's ufs_setattr returns 0 here ("Just ignore the request in other cases") — DragonFly diverges.
• sys/vfs/ext2fs/ext2_inode.c:458-491 — ext2_truncate has no vnode-type gate; for a FIFO with i_size=0x10000 > 0, ext2_ind_truncate (ext2_inode.c:225) runs the full shorten path.
• sys/vfs/ext2fs/ext2_inode.c:383-393 — the direct-block free loop frees every nonzero oip->i_db[i] via ext2_blkfree(); for special files those slots are NOT block pointers (for devices they overlay i_rdev).
• sys/vfs/ext2fs/ext2_alloc.c:1414-1431 — ext2_blkfree's only validation is bno < e2fs_bcount; a clear bitmap bit → unconditional panic(); a set bit → the block is silently freed even though another file still owns it.

Also reachable via unlink: ext2_inactive (ext2_inode.c:511-512) calls ext2_truncate(vp, 0, …) on any zero-link inode — deleting the crafted FIFO hits the same frees.

Reachability / impact ceiling

• Mounting the crafted image requires root (ext2 is not user-mountable on DragonFly) — same ceiling as DF-0888. The trigger itself is unprivileged whenever a user-accessible FIFO/device node exists on an ext2 mount (the crafted image ships mode-0666 FIFOs owned by root).
• Legitimate (non-crafted) images: any writable device node on an ext2 fs can have its i_db[0]=i_rdev clobbered by the lengthen path (ext2_balloc writes a fresh block number into i_db[0]) — persistent device-identity corruption by any user who can open the node O_RDWR.
• Variants: deterministic reboot-loopable panic (DoS) OR silent arbitrary in-range block free → cross-file aliasing → in-fs data disclosure and corruption. No kernel memory corruption (all frees are in-bcount), so no uid0 chain — ceiling is fs integrity/DoS, matching DF-3083/DF-3065 severity.

Fix

fix.diff: (1) ext2_setattr default: → return (0) (match FreeBSD); (2) defense-in-depth vnode-type gate in ext2_truncate itself (allow VREG/VDIR/VLNK — rename/rmdir/ext2_inactive legit callers only use those). Validated on a rebuilt kernel: ftruncate on both FIFOs returns 0 as a no-op, no panic, f_bfree unchanged, guest stays up (fix_run.log).

Files

Reproduce

HOST: python3 craft_img.py df3175.ext2 GUEST (image at /root/df3175.ext2, trigger built in /home/maxx/poc/DF-3175):

vm.sh run_root  'vnconfig -c vn0 /root/df3175.ext2 && mount -t ext2fs /dev/vn0 /mnt/df3175'
vm.sh run_user  'cd poc/DF-3175 && ./trigger /mnt/df3175/targetB'   # silent free
vm.sh run_root  'umount /mnt/df3175 && vnconfig -u vn0'             # then debugfs testb 26
vm.sh run_root  'vnconfig -c vn0 /root/df3175.ext2 && mount -t ext2fs /dev/vn0 /mnt/df3175'
vm.sh run_user  'cd poc/DF-3175 && ./trigger /mnt/df3175/targetA'   # panic

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.