DragonFlyBSD Kernel Audit
DF-2672 / fix.diff
← back to finding ↓ download raw
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -3626,6 +3626,15 @@
 		 */
 		if (dst_entry->ba.map_object != NULL) {
 			vm_map_backing_detach(dst_entry, &dst_entry->ba);
+			/*
+			 * Drop the reference vm_map_backing_replicated()
+			 * acquired for the cloned entry (the stale comment
+			 * claiming the ref-count was not yet adjusted
+			 * predates the backing_ba rework).  Without this
+			 * the object and its swap space leak permanently
+			 * whenever a wired entry is forked.
+			 */
+			vm_object_deallocate(dst_entry->ba.object);
 			dst_entry->ba.map_object = NULL;
 			vm_map_entry_dispose_ba(dst_entry,
 						dst_entry->ba.backing_ba);