Page MenuHomeFreeBSD

vm_page: Clear VM_ALLOC_NOCREAT in vm_page_grab_pflags()
ClosedPublic

Authored by markj on Aug 1 2025, 11:38 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Oct 13, 3:31 AM
Unknown Object (File)
Fri, Oct 10, 11:44 AM
Unknown Object (File)
Fri, Oct 10, 11:43 AM
Unknown Object (File)
Fri, Oct 10, 11:43 AM
Unknown Object (File)
Fri, Oct 10, 4:57 AM
Unknown Object (File)
Wed, Sep 24, 1:44 AM
Unknown Object (File)
Fri, Sep 19, 2:03 PM
Unknown Object (File)
Fri, Sep 19, 1:40 PM
Subscribers

Details

Summary

Otherwise vm_page_grab_zero_partial() and vm_page_grab_pages() can pass
it to vm_page_alloc_*(), which results in an assertion failure since
that flag is meaningless when allocating a page:

panic: invalid request 0x8400
cpuid = 0
time = 1754074745
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x49/frame 0xfffffe00542859c0
vpanic() at vpanic+0x1ea/frame 0xfffffe0054285b00
panic() at panic+0x43/frame 0xfffffe0054285b60
vm_page_alloc_domain_iter() at vm_page_alloc_domain_iter+0x720/frame 0xfffffe0054285be0
vm_page_grab_zero_partial() at vm_page_grab_zero_partial+0x1d4/frame 0xfffffe0054285c90
shm_fspacectl() at shm_fspacectl+0x1cd/frame 0xfffffe0054285d30
kern_fspacectl() at kern_fspacectl+0x49f/frame 0xfffffe0054285db0
sys_fspacectl() at sys_fspacectl+0x5b/frame 0xfffffe0054285e00
amd64_syscall() at amd64_syscall+0x29c/frame 0xfffffe0054285f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0054285f30

Reported by: syzkaller

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Aug 1 2025, 11:38 PM
kib accepted this revision.EditedAug 2 2025, 1:07 AM

May be its time to switch from &~() to &, i.e. allow explicitly listed flags.

This revision is now accepted and ready to land.Aug 2 2025, 1:07 AM
In D51692#1180692, @kib wrote:

May be its time to switch from &~() to &, i.e. allow explicitly listed flags.

Most of the VM_ALLOC_* flags should be passed through, so the length of the list wouldn't change much. I also like that we explicitly clear the NOWAIT, WAITOK, WAITFAIL flags here.