[Midnightbsd-cvs] [MidnightBSD/src] c7715b: vm: fix device pager page list use-after-free

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: c7715ba559d5ea91c63cbf58498e93bf0ffec9eb
      https://github.com/MidnightBSD/src/commit/c7715ba559d5ea91c63cbf58498e93bf0ffec9eb
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/vm/device_pager.c
    M sys/vm/vm_object.h
    M sys/vm/vm_page.c
    M tests/sys/vm/mmap_test.c

  Log Message:
  -----------
  vm: fix device pager page list use-after-free

Stop maintaining a separate unmanaged device pager page list and instead tear down device pages from the VM object memq. This avoids corrupting the device pager list when msync(MS_INVALIDATE) invalidates pages and a later fault reinserts them.

Add a regression test for the device pager reinsertion path.

This addresses FreeBSD-SA-26:37.vm / CVE-2026-49418.

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


  Commit: 896ba2ddc413e95c2f745443e24dbb9a500885fa
      https://github.com/MidnightBSD/src/commit/896ba2ddc413e95c2f745443e24dbb9a500885fa
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note CVE-2026-49418 VM fix

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


Compare: https://github.com/MidnightBSD/src/compare/8f879654c765...896ba2ddc413

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications