[Midnightbsd-cvs] [MidnightBSD/src] 37ee84: vm: fix device pager page list use-after-free

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 37ee84350d9ce292515ba0aaebd654ffaeef0b9c
      https://github.com/MidnightBSD/src/commit/37ee84350d9ce292515ba0aaebd654ffaeef0b9c
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M sys/vm/device_pager.c
    M sys/vm/vm_object.h
    M sys/vm/vm_page.c
    M tests/sys/vm/mmap_test.c

  Log Message:
  -----------
  vm: fix device pager page list use-after-free

Stop maintaining a separate unmanaged device pager page list and instead tear down device pages from the VM object memq. This avoids corrupting the device pager list when msync(MS_INVALIDATE) invalidates pages and a later fault reinserts them.

Add a regression test for the device pager reinsertion path.

This addresses FreeBSD-SA-26:37.vm / CVE-2026-49418.

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


  Commit: 3ebb1c8131c33016a418e5a213b25cd8eb2f0fbe
      https://github.com/MidnightBSD/src/commit/3ebb1c8131c33016a418e5a213b25cd8eb2f0fbe
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M UPDATING

  Log Message:
  -----------
  UPDATING: note CVE-2026-49418 VM fix

Signed-off-by: Lucas Holt <luke at foolishgames.com>

AI-Assisted-by: OpenAI Codex (GPT-5)


Compare: https://github.com/MidnightBSD/src/compare/55850c118d66...3ebb1c8131c3

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications