DF-2709 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 | --- sys/kern/kern_dmsg.c 2026-06-29 12:51:19.000000000 +0000 +++ /tmp/opencode/v26/fixtree/sys/kern/kern_dmsg.c 2026-10-24 16:53:55.813821054 +0000 @@ -92,8 +92,7 @@ #define kdmsg_state_hold(state) _kdmsg_state_hold(state) #define kdmsg_state_drop(state) _kdmsg_state_drop(state) #endif -static void _kdmsg_state_hold(kdmsg_state_t *state KDMSG_DEBUG_ARGS); -static void _kdmsg_state_drop(kdmsg_state_t *state KDMSG_DEBUG_ARGS); +/* DF-2709: prototypes now in <sys/dmsg.h> (exported for hammer2) */ static void kdmsg_iocom_thread_rd(void *arg); static void kdmsg_iocom_thread_wr(void *arg); @@ -227,10 +226,15 @@ (msg->any.head.cmd & DMSGF_DELETE)) { /* * iocom->conn_state has a state ref, drop it when clearing. + * + * DF-2709: conn_state is shared with hammer2_volconf_update() + * and other readers; interlock the drop with msglk. */ + lockmgr(&iocom->msglk, LK_EXCLUSIVE); if (iocom->conn_state) kdmsg_state_drop(iocom->conn_state); iocom->conn_state = NULL; + lockmgr(&iocom->msglk, LK_RELEASE); kdmsg_msg_reply(msg, 0); } @@ -901,6 +905,16 @@ msg->state = state; /* inherits freerd ref */ state->parent = pstate; KKASSERT(state->iocom == iocom); + /* + * DF-2711: cap the number of transactions a peer may + * have open; without a quota a peer can pin unbounded + * kernel memory (~160 bytes per state). + */ + if (iocom->peer_states >= KDMSG_MAX_PEER_STATES) { + error = DMSG_ERR_LOSTLINK; + break; + } + ++iocom->peer_states; state->flags |= KDMSG_STATE_RBINSERTED | KDMSG_STATE_SUBINSERTED | KDMSG_STATE_OPPOSITE; @@ -1727,7 +1741,6 @@ kdmsg_state_drop(state); } -static void _kdmsg_state_hold(kdmsg_state_t *state KDMSG_DEBUG_ARGS) { @@ -1737,7 +1750,6 @@ #endif } -static void _kdmsg_state_drop(kdmsg_state_t *state KDMSG_DEBUG_ARGS) { @@ -1759,8 +1771,11 @@ KKASSERT((state->flags & KDMSG_STATE_SUBINSERTED) == 0); KKASSERT(TAILQ_EMPTY(&state->subq)); - if (state != &state->iocom->state0) + if (state != &state->iocom->state0) { + if (state->flags & KDMSG_STATE_OPPOSITE) /* DF-2711 */ + --state->iocom->peer_states; kfree(state, iocom->mmsg); + } } kdmsg_msg_t * --- sys/vfs/hammer2/hammer2_iocom.c 2026-06-29 12:51:19.000000000 +0000 +++ /tmp/opencode/v26/fixtree/sys/vfs/hammer2/hammer2_iocom.c 2026-10-24 16:46:16.983664688 +0000 @@ -371,17 +371,26 @@ hammer2_volconf_update(hammer2_dev_t *hmp, int index) { kdmsg_msg_t *msg; + kdmsg_state_t *state; - /* XXX interlock against connection state termination */ - kprintf("volconf update %p\n", hmp->iocom.conn_state); - if (hmp->iocom.conn_state) { - kprintf("TRANSMIT VOLCONF VIA OPEN CONN TRANSACTION\n"); - msg = kdmsg_msg_alloc(hmp->iocom.conn_state, + /* + * DF-2709: interlock against connection state termination. + * Take a state reference under msglk so the peer-driven + * kdmsg_lnk_conn_reply drop cannot free it out from under us. + */ + lockmgr(&hmp->iocom.msglk, LK_EXCLUSIVE); + state = hmp->iocom.conn_state; + if (state) + _kdmsg_state_hold(state); + lockmgr(&hmp->iocom.msglk, LK_RELEASE); + if (state) { + msg = kdmsg_msg_alloc(state, DMSG_LNK_HAMMER2_VOLCONF, NULL, NULL); H2_LNK_VOLCONF(msg)->copy = hmp->voldata.copyinfo[index]; H2_LNK_VOLCONF(msg)->mediaid = hmp->voldata.fsid; H2_LNK_VOLCONF(msg)->index = index; kdmsg_msg_write(msg); + _kdmsg_state_drop(state); } } |