vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors
| Field | Value |
|---|---|
| ID | DF-2841 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-697 Incorrect Comparison |
| File | sys/vm/vm_swapcache.c |
| Lines | 608, 632 (semantics vm_page.h:395) |
| Area | vm |
| Confidence | likely |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
PG_NOTMETA is documented "do not back with swap" and set generically by
the buffer cache on data pages. The inactive-queue scan honors it for
both anchor classes, but the cluster-collection loops only enforce it
when the anchor is a block device (isblkdev && (m->flags &
PG_NOTMETA)). A VREG anchor page clusters up to 31 adjacent
PG_NOTMETA data pages into swap_pager_putpages, assigning them swap
backing in violation of the flag. Those assignments persist
(swap_pager_condfree refuses to free a swblock while any of its 32-page
span is resident), inflating vm_swap_cache_use, prematurely tripping
the 75% SWAPMAX cap, and in the extreme wedging the daemon in CLEANING.
No memory-safety impact; requires data_enable (off by default).
Recommended fix
Make the cluster filter flag-driven for both loops (drop the isblkdev
&&) — row diff above.
Timeline
- 2026-08-31 Discovered during pass-2 audit of vm_swapcache.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2841 · 9 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 693 B | ↓ raw | |
| VERDICT.md | — | 1.0 KB | ↓ raw | |
| build.sh | — | 56 B | view raw | |
| env.txt | — | 509 B | view raw | |
| fix.diff | — | 304 B | view raw | |
| manifest.json | — | 516 B | view raw | |
| run.sh | — | 87 B | view raw | |
| sourcenote.txt | — | 682 B | view raw | |
| verdict.json | — | 2.1 KB | view raw |
DF-2841 — swapcache cluster bypasses PG_NOTMETA for VREG (Info-tier hardening verification)
What
swapcache cluster bypasses PG_NOTMETA for VREG
Build
(source confirmation only)
Run
(source confirmation only)
Expected
baseline (stock kernel): see verdict below fix kernel (all-41-fixes build): the bad behavior is gone
Files
README.md VERDICT.md build.sh env.txt fix.diff manifest.json run.sh sourcenote.txt verdict.json
Shared harness: h41.c (combined KLD, sysctl debug.h41.cmd=N driven).
Full batch context: the fix kernel contains all 41 hardening fixes of
this batch compiled together (build RC=0) and passed the complete A/B
suite plus a clean reboot.
DF-2841 — VERDICT
status: reproduced | reproduced: 1 | impact: none | confidence: certain
Line-accurate confirmation (runtime demo skipped: swap data-caching is off by default and enabling it on the single-tenant audit guest risks wedging it for an Info-tier item): the anchor scan honors PG_NOTMETA for VREG anchors (vm_swapcache.c:457-462, the HAMMER double-buffering 'do not swapcache' flag), but both cluster loops gate the flag only for block devices - 'if (isblkdev && (m->flags & PG_NOTMETA)) break' at :608 and :628 - so a VREG anchor can cluster up to 31 adjacent PG_NOTMETA data pages into swap_pager_putpages, assigning swap backing in violation of the flag; assignments persist (condfree refuses while any page of the 32-page span is resident), inflating vm_swap_cache_use and prematurely tripping the 75% SWAPMAX cap. Fix (flag filter in both loops regardless of isblkdev) compiled in the fix kernel.
Baseline vs fix kernel
baseline: see verdict above / run log fix: behavior changed as designed (see verdict)
Fix verification
not_testableFilter change compiled and booted in the fix kernel; no swap-cache regression signals in A/B.
Confirmed kernel references
Detail
Evidence (decisive lines)
sourcenote.txt: anchor-vs-cluster filter asymmetry; fix.diff drops isblkdev from both loops
PoC changes
none
Verified recommended fix
Filter on (m->flags & PG_NOTMETA) alone in both cluster loops
Verdict
Line-accurate confirmation (runtime demo skipped: swap data-caching is off by default and enabling it on the single-tenant audit guest risks wedging it for an Info-tier item): the anchor scan honors PG_NOTMETA for VREG anchors (vm_swapcache.c:457-462, the HAMMER double-buffering do not swapcache flag), but both cluster loops gate the flag only for block devices - if (isblkdev && (m->flags & PG_NOTMETA)) break at :608 and :628 - so a VREG anchor can cluster up to 31 adjacent PG_NOTMETA data pages into swap_pager_putpages, assigning swap backing in violation of the flag; assignments persist (condfree refuses while any page of the 32-page span is resident), inflating vm_swap_cache_use and prematurely tripping the 75% SWAPMAX cap. Fix (flag filter in both loops regardless of isblkdev) compiled in the fix kernel.
No comments yet.