DF-2711
Unbounded peer-driven kdmsg_state allocation: no quota on transactions a peer may open (kernel memory exhaustion)
| Field | Value |
|---|---|
| ID | DF-2711 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-770 Allocation of Resources Without Limits |
| File | sys/kern/kern_dmsg.c |
| Lines | 898-917 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Every received LNK_CONN/LNK_SPAN CREATE allocates a persistent kdmsg_state_t (~160B + tree/subq refs) that is retained until the peer DELETEs it or the link tears down; there is no per-iocom cap. A peer can open millions of transactions (~64-448 wire bytes each) and pin unbounded kernel heap from the HAMMER2-msg zone. Breadth-wise complement of DF-0017 (which covered depth/recursion). Affects any dmsg consumer (hammer2 iocom, xdisk via subr_diskiocom AUTO flags).
Recommended fix
Cap the number of open peer-created states per iocom (count RB entries in staterd_tree under msglk; reject CREATEs beyond e.g. 65536 with EINVAL, matching the existing error handling that discards the message without killing the link).
Timeline
- 2026-08-30 Discovered during pass-2 audit of kern_dmsg.c (GLM 5.3).
No comments yet.