Stale comments describe retired page-swapblk design, misdocumenting the OBJT_DEFAULT no-swap-metadata invariant that three files silently depend on
| Field | Value |
|---|---|
| ID | DF-2982 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-1078 |
| File | sys/vm/default_pager.c |
| Lines | 33-39, 100-104, 112-117, 125-135 |
| Area | vm |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vm |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
default_pager.c's header and per-function comments describe a design that no longer exists: they claim vm_page carries a '->swapblk' field for OBJT_DEFAULT pages, that the object is converted to OBJT_SWAP only 'when the page is physically freed', and that default_pager_haspage() 'just call[s] swap_pager_haspage()'. In the actual code vm_page has no swapblk field, conversion is immediate and atomic at first metadata build (swap_pager.c:2345-2347, 1606-1608), and default_pager_haspage returns FALSE unconditionally. The code is correct; the documentation is not. No direct runtime impact β the hazard is maintenance: the OBJT_DEFAULT β swblock_count==0 invariant is load-bearing for three unrelated enforcement points (default_pager_dealloc's KKASSERT, vm_fault's zero-fill-on-FAIL correctness, the DRM shims' vm_pager_has_page use), none of which is documented anywhere except these wrong comments. A future maintainer 'restoring' the documented behavior would silently break anonymous-memory data integrity or turn the dealloc KKASSERT into a user-triggerable panic. Fix: rewrite the comments (row diff). Executable code proven clean this pass.
Timeline
- 2026-09-02 Discovered during pass-2 audit of default_pager.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2982 Β· 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | β | 238 B | β raw | |
| fix.diff | β | 1.9 KB | view raw | |
| manifest.json | β | 378 B | view raw | |
| verdict.json | β | 1.6 KB | view raw |
DF-2982 evidence pack
What
default_pager.c comments describe the retired page-swapblk design
Verdict
status=not_reproduced impact=none confidence=certain
See VERDICT.md for the full narrative and fix.diff for the verified fix.
Fix verification
not_testablefix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff
PoC changes
n/a - comment-only
Verified recommended fix
rewrite the retired-design comments; document the swblock_count==0 invariant
Verdict
Comment-only finding: nothing executable to reproduce. Line-confirmed that the header comment (default_pager.c:37-38) still claims vm_page carries a ->swapblk field and that OBJT_DEFAULT objects convert only when pages are physically freed, and the haspage comment still says it calls swap_pager_haspage() while the code returns FALSE unconditionally (default_pager.c:139-141). The swblock_count==0 invariant is load-bearing for default_pager_dealloc KKASSERT (:97), vm_fault zero-fill-on-FAIL (vm_fault.c:2290-2329) and the DRM shims (linux_shmem.c:66, ttm_tt.c:372). Comment rewrite applied and compiled as part of the F40FIX build.
No comments yet.