vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors
| Field | Value |
|---|---|
| ID | DF-2841 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-697 Incorrect Comparison |
| File | sys/vm/vm_swapcache.c |
| Lines | 608, 632 (semantics vm_page.h:395) |
| Area | vm |
| Confidence | likely |
| Discovered | 2026-08-31 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
PG_NOTMETA is documented "do not back with swap" and set generically by
the buffer cache on data pages. The inactive-queue scan honors it for
both anchor classes, but the cluster-collection loops only enforce it
when the anchor is a block device (isblkdev && (m->flags &
PG_NOTMETA)). A VREG anchor page clusters up to 31 adjacent
PG_NOTMETA data pages into swap_pager_putpages, assigning them swap
backing in violation of the flag. Those assignments persist
(swap_pager_condfree refuses to free a swblock while any of its 32-page
span is resident), inflating vm_swap_cache_use, prematurely tripping
the 75% SWAPMAX cap, and in the extreme wedging the daemon in CLEANING.
No memory-safety impact; requires data_enable (off by default).
Recommended fix
Make the cluster filter flag-driven for both loops (drop the isblkdev
&&) — row diff above.
Timeline
- 2026-08-31 Discovered during pass-2 audit of vm_swapcache.c (GLM 5.3).
No comments yet.