DF-2749
journal_wthread pad-skip accounting bug: total_acked += bytes counts all pending bytes instead of the pad size, inflating bytessent (MOUNTCTL_STATUS)
| Field | Value |
|---|---|
| ID | DF-2749 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-682 Incorrect Calculation |
| File | sys/kern/vfs_journal.c |
| Lines | 220-221 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
When the worker skips a pad record it advances rindex by the aligned
pad size but does jo->total_acked += bytes where bytes = windex -
rindex (everything still pending), double-counting and pre-counting
unwritten data; bytessent (mountctl status) becomes garbage under pad
churn, breaking consumer-side reconciliation of the mirror stream. Fix
included and validated in the DF-2747 patched-kernel build.
Recommended fix
--- a/sys/kern/vfs_journal.c
+++ b/sys/kern/vfs_journal.c
@@ -220,7 +220,7 @@
jo->fifo.rindex += (rawp->recsize + 15) & ~15;
- jo->total_acked += bytes;
+ jo->total_acked += (rawp->recsize + 15) & ~15; /* DF-2749 */
Timeline
- 2026-08-30 Discovered during pass-2 audit of vfs_journal.c (GLM 5.3).
No comments yet.