DF-2766 — journal_remove_all_journals() never detaches: mnt_jbitmap (1024 B) leaks on every journaled unmount

What

journal_remove_all_journals() (sys/kern/vfs_jops.c:422-430) — called from dounmount() (sys/kern/vfs_syscalls.c:1037) after VFS_UNMOUNT — destroys every journal but, unlike the MOUNTCTL_REMOVE_VFS_JOURNAL path in journal_mountctl() (:208-209), never calls journal_detach(). mnt_jbitmap (JREC_STREAMID_JMAX/8 = 1024 bytes, M_JOURNAL, allocated in journal_attach() :240) is therefore leaked when a journaled mount is unmounted. It is the only code that frees the bitmap besides journal_detach() (:251), and nothing in the mount destruction path (vfs_mount.c:403 kfree(mp)) touches it — 1024 bytes per journaled mount/unmount cycle, unbounded for mount-loop workloads (synth, poudriere-style chroots with journaling).

PoC (reproduced, stock kernel)

vmstat -m | grep -w journal                       # baseline: 0 in use
for i in 1..5:
    mount -t tmpfs tmpfs /mnt/leak
    mountctl -a -w /root/jl_$i.bin /mnt/leak:L$i
    umount /mnt/leak
vmstat -m | grep -w journal                       # 5 allocs / 5.00K in use

Observed: journal 5 5.00K after 5 cycles (5 x 1024 B), while journal-fifo returned to 0 (the FIFO membase IS freed by journal_destroy) — the delta is exactly the leaked bitmaps. See run.log.

Fix

Call journal_detach() from journal_remove_all_journals() when the list drains (dounmount already holds mnt_token; journal_detach is made idempotent by the DF-2763 fix). See fix.diff.

DF-2766 — VERDICT

Status: reproduced (exact accounting match), fix validated.

Baseline (stock kernel)

5 x (mount tmpfs; mountctl -a; umount) cycles:

journal    0  0     ->  5  5.00K   (in-use after 5 cycles)
journal-fifo 0      ->  0          (membase properly freed)

5.00K = 5 x 1024 B = JREC_STREAMID_JMAX/8 = the leaked mnt_jbitmap blocks (M_JOURNAL). Only journal_detach() (vfs_jops.c:251) frees them, and journal_remove_all_journals() (vfs_jops.c:422-430, called from dounmount vfs_syscalls.c:1037) never calls it — unlike the MOUNTCTL_REMOVE path (:208-209). Nothing in the mount destructor (vfs_mount.c:403 kfree(mp)) touches mnt_jbitmap. run.log.

Fix (validated on kernel #2)

journal_remove_all_journals() now calls journal_detach() when the list drains (fix.diff hunk 3; journal_detach made idempotent by the DF-2763 hunks; dounmount already holds mnt_token). Post-fix, the same 5-cycle run leaves journal in-use at 0 (alloc count 255->265, all freed). run_fixed.log.

Impact

1 KB leak per journaled mount/unmount cycle, unbounded across mount-loop workloads. Root-gated (journal install), no memory-safety consequence. Severity Low (CWE-401).