hammer2_vop_reclaim kprintf discloses vp/ip kernel pointers to the console/msgbuf
Summary
'hammer2: vp=%p ip=%p unlinked but not disposed' prints two live kernel virtual addresses on the unlinked-not-disposed reclaim path — same class as DF-2637 (hammer2_inode.c sites); this is the vnops.c site it does not cover. Static (underlying inactive/sideq race not deterministically triggerable; Info severity). Drop-the-%p fix proposed.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5821 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 924 B | ↓ raw | |
| verdict.json | — | 1.4 KB | view raw |
DF-5821 — hammer2_vop_reclaim prints kernel pointers (vp, ip) to the console/msgbuf
Code (certain)
hammer2_vop_reclaim (sys/vfs/hammer2/hammer2_vnops.c:183-184):
kprintf("hammer2: vp=%p ip=%p unlinked but not disposed\n",
vp, ip);
vp/ip are kernel virtual addresses. The message fires on the
"unlinked-but-not-disposed" reclaim path (inactive-sideq race). Anyone who
can read the msgbuf (console dmesg) obtains two live KVA pointers — the
same disclosure class as DF-2637 (hammer2_inode.c sites); this is the
hammer2_vnops.c site not covered by it.
PoC
Not separately run: triggering the underlying inactive/reclaim race deterministically is impractical (stress harness in DF-5820's pack ran 120 s without hitting the sibling race); the kprintf itself is trivially readable in source. Info severity — hardening.
Fix
kprintf("hammer2: unlinked inode not disposed\n");
(drop the %p arguments.)
Fix verification
not_testablenot_testable: requires deterministically hitting the inactive/reclaim sideq race.
Confirmed kernel references
Detail
Evidence (decisive lines)
README.md citing hammer2_vnops.c:183-184.
PoC changes
none; static.
Verified recommended fix
Drop the %p arguments from the kprintf.
Verdict
hammer2_vop_reclaim prints 'hammer2: vp=%p ip=%p unlinked but not disposed' (hammer2_vnops.c:183-184), disclosing two kernel virtual addresses to the console/msgbuf on the unlinked-not-disposed reclaim path. Source-certain hardening issue (same class as DF-2637's hammer2_inode.c sites, distinct site in this file); the underlying inactive/sideq race was not deterministically triggerable, so no live capture was produced.
No comments yet.