[DragonFlyBSD - Bug #3435] (New) hammer2: kdmsg can leak connection state during reconnect

[sigttou]

Issue #3435 has been reported by sigttou.

----------------------------------------
Bug #3435: hammer2: kdmsg can leak connection state during reconnect
http://bugs.dragonflybsd.org/issues/3435

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
HAMMER2 can report memory still allocated after unmount. Repeated connections
that close during startup can leave connection-state objects allocated.

kdmsg_iocom_autoinitiate() can create a connection transaction after the
writer has stopped. The state can survive into the next connection, where
conn_state is replaced without releasing its old reference.
A close callback also clears whichever state conn_state currently points
to. If another connection has replaced it, the callback releases the new
state's reference and leaves the old state's reference behind.

Fix:
Hold msglk across transaction creation, publication and queuing. Do not
start a new transaction once EXITNOACC says the writer is shutting down.
Allow the allocator to acquire the same lock recursively for this path.
Release the old conn_state reference before replacing it. A close callback
clears and releases the slot only if it still points to that callback's
state. This reference cleanup is separate from deciding whether to send
a closing reply.



---Files--------------------------------
0002-kdmsg-fix-connection-state-lifetime.patch (3.13 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account