β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-2982

Stale comments describe retired page-swapblk design, misdocumenting the OBJT_DEFAULT no-swap-metadata invariant that three files silently depend on

Field Value
ID DF-2982
Status new
Severity Info
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE CWE-1078
File sys/vm/default_pager.c
Lines 33-39, 100-104, 112-117, 125-135
Area vm
Confidence certain
Discovered 2026-09-02
Pass 2 (GLM 5.3 second pass)
Bucket base:vm
Reported pending
Known CVE none
CVE match novel

Summary

default_pager.c's header and per-function comments describe a design that no longer exists: they claim vm_page carries a '->swapblk' field for OBJT_DEFAULT pages, that the object is converted to OBJT_SWAP only 'when the page is physically freed', and that default_pager_haspage() 'just call[s] swap_pager_haspage()'. In the actual code vm_page has no swapblk field, conversion is immediate and atomic at first metadata build (swap_pager.c:2345-2347, 1606-1608), and default_pager_haspage returns FALSE unconditionally. The code is correct; the documentation is not. No direct runtime impact β€” the hazard is maintenance: the OBJT_DEFAULT β‡’ swblock_count==0 invariant is load-bearing for three unrelated enforcement points (default_pager_dealloc's KKASSERT, vm_fault's zero-fill-on-FAIL correctness, the DRM shims' vm_pager_has_page use), none of which is documented anywhere except these wrong comments. A future maintainer 'restoring' the documented behavior would silently break anonymous-memory data integrity or turn the dealloc KKASSERT into a user-triggerable panic. Fix: rewrite the comments (row diff). Executable code proven clean this pass.

Timeline

  • 2026-09-02 Discovered during pass-2 audit of default_pager.c (GLM 5.3).

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2982 Β· 4 files
FileTypeDescriptionSize
README.md β€” 238 B ↓ raw
fix.diff β€” 1.9 KB view raw
manifest.json β€” 378 B view raw
verdict.json β€” 1.6 KB view raw

DF-2982 evidence pack

What

default_pager.c comments describe the retired page-swapblk design

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-2982

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - comment-only

Verified recommended fix

rewrite the retired-design comments; document the swblock_count==0 invariant

Verdict

Comment-only finding: nothing executable to reproduce. Line-confirmed that the header comment (default_pager.c:37-38) still claims vm_page carries a ->swapblk field and that OBJT_DEFAULT objects convert only when pages are physically freed, and the haspage comment still says it calls swap_pager_haspage() while the code returns FALSE unconditionally (default_pager.c:139-141). The swblock_count==0 invariant is load-bearing for default_pager_dealloc KKASSERT (:97), vm_fault zero-fill-on-FAIL (vm_fault.c:2290-2329) and the DRM shims (linux_shmem.c:66, ttm_tt.c:372). Comment rewrite applied and compiled as part of the F40FIX build.