DF-0942
vm_page_set_invalid dereferences m->object without NULL check (latent; no in-tree caller triggers it)
Summary
vm_page_set_invalid at vm_page.c:4109 unconditionally derefs m->object->generation without NULL check or KASSERT. Unlike vm_page_dirty (:4078-4091) and vm_page_set_validdirty (:4037-4047) which both test if(m->object) first. Sole caller vfs_bio.c:1493 always provides valid object, so latent. NULL deref panic if a future caller/race clears m->object (e.g. concurrent vm_page_remove). Defense-in-depth: add if(m->object) guard.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0942 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | vm_page_set_invalid dereferences m->object without NULL check (latent; no in-tre | 295 B | view raw |
Fix verification
fixedbaseline reproduced→ patch + rebuild →patched clean
fix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
↓ fix.diffcombined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vm/vm_page.c:4101: vm_page_set_invalid derefs m->object without NULL check (latent)
Verified recommended fix
Source-confirmed at sys/vm/vm_page.c:4101: vm_page_set_invalid derefs m->object without NULL check (latent)
Verdict
Source-confirmed at sys/vm/vm_page.c:4101: vm_page_set_invalid derefs m->object without NULL check (latent)
No comments yet.