[Midnightbsd-cvs] [MidnightBSD/src] 331cb2: vm: fix device pager page list use-after-free

[Lucas Holt]

  Branch: refs/heads/stable/4.1
  Home:   https://github.com/MidnightBSD/src
  Commit: 331cb2d670f1c3c2f268bfb08798afb9ad2210c4
      https://github.com/MidnightBSD/src/commit/331cb2d670f1c3c2f268bfb08798afb9ad2210c4
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/vm/device_pager.c
    M sys/vm/vm_object.h
    M sys/vm/vm_page.c
    M tests/sys/vm/mmap_test.c

  Log Message:
  -----------
  vm: fix device pager page list use-after-free

Stop maintaining a separate unmanaged device pager page list and instead tear down device pages from the VM object memq. This avoids corrupting the device pager list when msync(MS_INVALIDATE) invalidates pages and a later fault reinserts them.

Add a regression test for the device pager reinsertion path.

This addresses FreeBSD-SA-26:37.vm / CVE-2026-49418.

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


  Commit: 6654c0914a72891eec7222558ad16f73879d2397
      https://github.com/MidnightBSD/src/commit/6654c0914a72891eec7222558ad16f73879d2397
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note CVE-2026-49418 VM fix

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


Compare: https://github.com/MidnightBSD/src/compare/3582f92ee212...6654c0914a72

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications