Fix two issues with mprotect(PROT_WRITE) and wiring.

[kib]

Summary

There are two fixes for vm_fault_copy_entry():

• We should not assert that entry is charged if the dst_object is not of swap type. It can only happen when entry does not require copy, otherwise vm_map_protect() already adds the charge. So the assert was right for the case where swap object was allocated in the vm_fault_copy_entry(), but not when it was just copied from src_entry and its type is not swap.
• if a wired map entry is backed by vnode and the file is truncated, corresponding pages are invalidated. vm_fault_copy_entry() should be aware of it and allow for invalid pages past end of file. Also, such pages should be not mapped into userspace.

Found by: andrew using syzkaller

[kib]

sys/vm/vm_fault.c

1745 ↗

(On Diff #48461)

As I noted elsewere, this assert might be reasonable dropped at all due to msync(MS_INVALIDATE).

[alc]

sys/vm/vm_fault.c

1653 ↗

(On Diff #48461)

I think it clearer to include the new conditions here, and not in the KASSERT:

} else if ((dst_object->type == OBJT_DEFAULT ||
    dst_object->type == OBJT_SWAP)  &&
    dst_object->cred == NULL)

This will add to the run-time cost of handling DEFAULT and SWAP objects, but eliminate the pointless assignments for other types of objects.

1745 ↗

(On Diff #48461)

Thinking ...

[alc]

sys/vm/vm_fault.c

1642 ↗

(On Diff #48461)

On an unrelated note, couldn't the assignments here to the object move up to the previous "else"? They don't need to be here any more than the assignments to pg_color or flags. (The object is effectively private for a short time after creation.)

[kib]

Move all dst_object initialization lines into creation block.
Rearrange conditional in if vs KASSERT.

[alc]

sys/vm/vm_fault.c

1738 ↗

(On Diff #48487)

Couldn't we simply break out of the enclosing "for" loop here if src_m is after the end of the object? Then, neither the KASSERT nor pmap_enter() call would have to change. Moreover, further iterations of the loop are pointless.

[kib]

End the loop if out of bounds.

[alc]

sys/vm/vm_fault.c

1742–1749 ↗

(On Diff #48530)

Can't you reorder things so that the xunbusy() isn't needed? In other words, move the xbusy() below the "if" statement. Otherwise, this looks good to me.

[kib]

Remove xunbusy(). Reduce diff.