[DragonFlyBSD - Bug #3435] hammer2: kdmsg can leak connection state during reconnect

[sigttou]

Issue #3435 has been updated by sigttou.

File v2-0001-kdmsg-protect-connection-state-publication-and-ownership.patch added

Attached v2, which uses a locked allocator helper instead of recursive lock acquisition. Rebased on current master.

@kdmsg_msg_alloc()@ now wraps an internal @kdmsg_msg_alloc_impl()@. A static @kdmsg_msg_alloc_locked()@ is used only by @kdmsg_iocom_autoinitiate()@, which holds msglk across creating, publishing and queuing the CONN transaction. msglk stays non-recursive, and other callers are unchanged.



----------------------------------------
Bug #3435: hammer2: kdmsg can leak connection state during reconnect
http://bugs.dragonflybsd.org/issues/3435#change-14872

* Author: sigttou
* Status: In Progress
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
HAMMER2 can report memory still allocated after unmount. Repeated connections
that close during startup can leave connection-state objects allocated.

kdmsg_iocom_autoinitiate() can create a connection transaction after the
writer has stopped. The state can survive into the next connection, where
conn_state is replaced without releasing its old reference.
A close callback also clears whichever state conn_state currently points
to. If another connection has replaced it, the callback releases the new
state's reference and leaves the old state's reference behind.

Fix:
Hold msglk across transaction creation, publication and queuing. Do not
start a new transaction once EXITNOACC says the writer is shutting down.
Allow the allocator to acquire the same lock recursively for this path.
Release the old conn_state reference before replacing it. A close callback
clears and releases the slot only if it still points to that callback's
state. This reference cleanup is separate from deciding whether to send
a closing reply.



---Files--------------------------------
0002-kdmsg-fix-connection-state-lifetime.patch (3.13 KB)
v2-0001-kdmsg-protect-connection-state-publication-and-ownership.patch (5.01 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account