DF-0018 / fix.diff
diff --git a/sys/kern/kern_dmsg.c b/sys/kern/kern_dmsg.c --- a/sys/kern/kern_dmsg.c +++ b/sys/kern/kern_dmsg.c @@ -952,6 +952,20 @@ } break; } + + /* + * A duplicate DELETE can race our reply transmission (the + * writer has not yet transmitted our REPLY|DELETE, so the + * state is still in staterd_tree with rxcmd already carrying + * DMSGF_DELETE). Discard it benignly instead of tripping the + * KKASSERT below (kern_dmsg.c:1076). + */ + if (state->rxcmd & DMSGF_DELETE) { + kdio_printf(iocom, 1, "%s\n", + "msgrx: duplicate DELETE"); + error = EALREADY; + break; + } error = 0; break; default: |