vm.swapcache.* tunables accept unbounded/negative values, wedging the swapcache daemon state machine and burst accounting
| Field | Value |
|---|---|
| ID | DF-2840 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |
| CWE | CWE-20 / CWE-670 |
| File | sys/vm/vm_swapcache.c |
| Lines | 120-153 (consumers :258-275, :290-291, :363-367) |
| Area | vm |
| Confidence | certain |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
Every vm.swapcache knob is a plain CTLFLAG_RW int/quad with no validation. Negative or zero values flow straight into the daemon's hysteresis/burst/state math: accrate<0 drains curburst without bound so the SWAPB_RECOVERING gate is never satisfied and writing stops permanently; maxswappct<0 makes SWAPMAX negative so vm_swap_cache_use (unsigned) can never fall below it and the state machine wedges in SWAPC_CLEANING forever; min_hysteresis<0 breaks the clamp; maxlaunder/maxscan≤0 degenerate the scans. Root-only misconfiguration — privileged self-inflicted livelock/disable of the swap-cache accelerator. Same family as DF-2833 but distinct knobs/file.
Recommended fix
Clamp at the consumption points (accrate>0 before accumulating; maxswappct to [0,100]; min_hysteresis ≥0) — sketch diff in the row above.
Timeline
- 2026-08-31 Discovered during pass-2 audit of vm_swapcache.c (GLM 5.3).
No comments yet.