DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2749

journal_wthread pad-skip accounting bug: total_acked += bytes counts all pending bytes instead of the pad size, inflating bytessent (MOUNTCTL_STATUS)

Field Value
ID DF-2749
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE CWE-682 Incorrect Calculation
File sys/kern/vfs_journal.c
Lines 220-221
Area kern
Confidence certain
Discovered 2026-08-30
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

When the worker skips a pad record it advances rindex by the aligned pad size but does jo->total_acked += bytes where bytes = windex - rindex (everything still pending), double-counting and pre-counting unwritten data; bytessent (mountctl status) becomes garbage under pad churn, breaking consumer-side reconciliation of the mirror stream. Fix included and validated in the DF-2747 patched-kernel build.

--- a/sys/kern/vfs_journal.c
+++ b/sys/kern/vfs_journal.c
@@ -220,7 +220,7 @@
        jo->fifo.rindex += (rawp->recsize + 15) & ~15;
-       jo->total_acked += bytes;
+       jo->total_acked += (rawp->recsize + 15) & ~15;  /* DF-2749 */

Timeline

  • 2026-08-30 Discovered during pass-2 audit of vfs_journal.c (GLM 5.3).

Discussion (0)

No comments yet.