[DragonFlyBSD - Bug #3435] hammer2: kdmsg can leak connection state during reconnect

[sigttou]

Issue #3435 has been updated by sigttou.


My intention was to allow recursion only at the allocator’s tree-insertion acquisition, rather than enabling it for all acquisitions of msglk. Setting `LK_CANRECURSE` in `lockinit()` instead would permit recursion at every acquisition of this lock. The submitted approach is narrower: other acquisition sites retain the check against unintended recursion.

The nesting here is intentional: autoinitiate holds msglk across the EXITNOACC check, transaction creation, conn_state publication and queuing. The allocator temporarily takes and releases an additional exclusive reference; autoinitiate then queues through `kdmsg_msg_write_locked()` and releases its outer reference.

If a locked allocator helper is preferable to per-call recursion, I’m happy to revise and retest that approach.

----------------------------------------
Bug #3435: hammer2: kdmsg can leak connection state during reconnect
http://bugs.dragonflybsd.org/issues/3435#change-14789

* Author: sigttou
* Status: In Progress
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
HAMMER2 can report memory still allocated after unmount. Repeated connections
that close during startup can leave connection-state objects allocated.

kdmsg_iocom_autoinitiate() can create a connection transaction after the
writer has stopped. The state can survive into the next connection, where
conn_state is replaced without releasing its old reference.
A close callback also clears whichever state conn_state currently points
to. If another connection has replaced it, the callback releases the new
state's reference and leaves the old state's reference behind.

Fix:
Hold msglk across transaction creation, publication and queuing. Do not
start a new transaction once EXITNOACC says the writer is shutting down.
Allow the allocator to acquire the same lock recursively for this path.
Release the old conn_state reference before replacing it. A close callback
clears and releases the slot only if it still points to that callback's
state. This reference cleanup is separate from deciding whether to send
a closing reply.



---Files--------------------------------
0002-kdmsg-fix-connection-state-lifetime.patch (3.13 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account