DF-2891
contigmalloc_map silently ignores its map argument — kmap always allocates from kernel_map; a caller freeing via its own map corrupts the wrong vm_map
| Field | Value |
|---|---|
| ID | DF-2891 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-628 Function Call with Incorrectly Specified Arguments |
| File | sys/vm/vm_contig.c |
| Lines | 527, 563, 577 |
| Area | vm |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
contigmalloc_map(..., vm_map_t map) forwards map to
vm_contig_pg_kmap, which never uses it — KVA is unconditionally taken
from kernel_map (:527); the doc comment admits the contract. A future
caller passing a non-kernel map (the exported API shape invites it)
will kmem_free() an address from a map with no entry for it — vm_map
entry corruption/panic — while the real entry leaks in kernel_map. No
current in-tree caller passes a different map — latent API trap. Fix:
KKASSERT(map == kernel_map) (and long-term drop the parameter).
Timeline
- 2026-09-02 Discovered during pass-2 audit of vm_contig.c (GLM 5.3).
No comments yet.