Fix memory modified after free with DEBUG_MEMGUARD

[ngie]

Summary

Fix memory modified after free with DEBUG_MEMGUARD

Protect slabs properly [that are larger than PAGE_SIZE] with memguard
vm.memguard.options=2 or vm.memguard.options=3 set by not double-counting
slab vs non-slab allocations

PR: 191359
Reported by: pho
Submitted by: Luke Chang-Hsien Tsai <[e-mail]>

Test Plan

• Run the following commands for a few minutes:

% sysctl vm.memguard.options=3; sysctl vm.memguard.desc=allocdirect
% for i in seq 1 10; do

dd if=/dev/urandom of=/dev/stdout bs=20m | ssh -C 172.16.98.155 tar xf - &
done

%

• memguard4 scenario from stress2 (still needs to be run)

[pho]

I'm unfortunately still able to get a panic using ssh:
http://people.freebsd.org/~pho/stress/log/memguard7.txt

[glebius]

The BUGS section of the manual page should be fixed, if the patch gets working.

[glebius]

What actually is "allocdirect"? I can't find it in 'vmstat -m' neither in 'vmstat -z'.

[pho]

The content of "desc" does not seem to have any impact on this panic:

FreeBSD 11.0-CURRENT (MEMGUARD) #3 r278882M: Tue Feb 17 12:42:28 CET 2015
You have new mail.
root@t1:~ # sysctl vm.memguard.desc=temp; sysctl vm.memguard.options=3
vm.memguard.desc: -> temp
vm.memguard.options: 1 -> 3
root@t1:~ # ssh pho@localhost
Memory modified after free 0xfffffe0000430000(4096) val=5a5a5a5a @ 0xfffffe0000430000

Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address = 0x3000
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80bf0053
stack pointer = 0x28:0xfffffe1728bfd1b0
frame pointer = 0x28:0xfffffe1728bfd200
code segment = base 0x0, limit 0xfffff, type 0x1b
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 946 (sshd)
[ thread pid 946 tid 100429 ]
Stopped at uma_find_refcnt+0x33: movq (%rax),%rax
db>
$

[ngie]

Based on input from pho@, I'm more convinced that there's an issue elsewhere [in the network stack?] that needs to be addressed.

Closing this CR but will reopen if more information comes to light as to whether or not this is the issue that needs to be fixed.