DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2841

vm_swapcached_flush cluster members bypass the PG_NOTMETA 'do not back with swap' filter for VREG anchors

Field Value
ID DF-2841
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE CWE-697 Incorrect Comparison
File sys/vm/vm_swapcache.c
Lines 608, 632 (semantics vm_page.h:395)
Area vm
Confidence likely
Discovered 2026-08-31
Pass 2 (GLM 5.3 second pass)
Bucket base:vm
Reported pending
Known CVE none
CVE match novel

Summary

PG_NOTMETA is documented "do not back with swap" and set generically by the buffer cache on data pages. The inactive-queue scan honors it for both anchor classes, but the cluster-collection loops only enforce it when the anchor is a block device (isblkdev && (m->flags & PG_NOTMETA)). A VREG anchor page clusters up to 31 adjacent PG_NOTMETA data pages into swap_pager_putpages, assigning them swap backing in violation of the flag. Those assignments persist (swap_pager_condfree refuses to free a swblock while any of its 32-page span is resident), inflating vm_swap_cache_use, prematurely tripping the 75% SWAPMAX cap, and in the extreme wedging the daemon in CLEANING. No memory-safety impact; requires data_enable (off by default).

Make the cluster filter flag-driven for both loops (drop the isblkdev &&) — row diff above.

Timeline

  • 2026-08-31 Discovered during pass-2 audit of vm_swapcache.c (GLM 5.3).

Discussion (0)

No comments yet.