diff options
| author | Abdelkader Boudih <freebsd@seuros.com> | 2026-07-31 15:46:38 +0000 |
|---|---|---|
| committer | Adrian Chadd <adrian@FreeBSD.org> | 2026-07-31 15:46:45 +0000 |
| commit | ff97443beef614a12652cb96ccebe95e9046e82a (patch) | |
| tree | 5b5dca3cfea446d08185f1f0a47056eca6d34fd1 | |
| parent | 1c1a3646a1c86624e67a42636894fd1685386cf1 (diff) | |
kqueue: do not buffer the whole knote report when sizing it
kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.
A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D58536
PR: 296835
MFC after: 1 week
| -rw-r--r-- | sys/kern/kern_event.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index 28e31a227357..e8395707a29d 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -3359,18 +3359,18 @@ kern_proc_kqueues_out(struct proc *p, struct sbuf *sb, size_t maxlen, size_t sb_len; int error; - if (maxlen == -1 || maxlen == 0) + if (maxlen == -1) + return (kern_proc_kqueues_out1(curthread, p, sb, compat32)); + + if (maxlen == 0) sb_len = 128; else sb_len = maxlen; - s = sbuf_new(&sm, NULL, sb_len, maxlen == -1 ? SBUF_AUTOEXTEND : - SBUF_FIXEDLEN); + s = sbuf_new(&sm, NULL, sb_len, SBUF_FIXEDLEN); error = kern_proc_kqueues_out1(curthread, p, s, compat32); sbuf_finish(s); - if (error == 0) { - sbuf_bcat(sb, sbuf_data(s), MIN(sbuf_len(s), maxlen == -1 ? - SIZE_T_MAX : maxlen)); - } + if (error == 0) + sbuf_bcat(sb, sbuf_data(s), MIN(sbuf_len(s), maxlen)); sbuf_delete(s); return (error); } |