tmpfs_reg_resize shrink path: 'aobj->size = osize;' self-assignment dead store — swap-object size never reduced after truncate (intended aobj->size = nsize), live upstream
Summary
In tmpfs_reg_resize's shrink branch, osize is loaded from aobj->size (:1055), and the 'resize' assignment at :1058 writes osize back - a no-op self-assignment. The surrounding cleanup (swap_pager_freespace(aobj, nsize, osize-nsize), vm_object_page_remove(aobj, nsize, osize)) clearly intends to shrink the swap-backed object's coverage to nsize, and the grow path resynchronizes it unconditionally (:1088). Because of the dead store, aobj->size remains at the old high-water mark until the next grow. Line identical in DragonFlyBSD master - live upstream. Impact-audited benign in the current call graph (vm_page_rename does not bound-check; swap_pager_freespace idempotent; no path inserts pages beyond nsize; later ranges use the same stale value so cleanup stays consistent; deallocate frees the whole memq regardless). Security-relevant only as a latent trap: any future consumer trusting aobj->size to bound valid swap assignments inherits a lie after every truncate. Not userland-observable; Phase V skipped (Low). Fix: aobj->size = nsize. [VERIFIED pass2: line-verified dead store aobj size - no userland-observable behavior, reproduction impossible by construction]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3070 · 7 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 291 B | ↓ raw | |
| VERDICT.md | — | 1.1 KB | ↓ raw | |
| env.txt | — | 248 B | view raw | |
| fix.diff | — | 68 B | view raw | |
| manifest.json | — | 526 B | view raw | |
| run.log | — | 125 B | view raw | |
| verdict.json | — | 1.2 KB | view raw |
DF-3070 - tmpfs_reg_resize shrink path: aobj->size = osize self-assignment dead store
Severity Low | verdict: not_reproduced | impact: none
Reproduce
No runnable PoC on this rig (see VERDICT.md for why).
See VERDICT.md for the full narrative and run.log for the decisive output.
DF-3070 verification
Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Line-verified dead store: tmpfs_subr.c:1058 writes osize (loaded from aobj->size at :1055) back into aobj->size - a no-op; the surrounding cleanup (swap_pager_freespace/vm_object_page_remove over [nsize, osize)) shows the intent was aobj->size = nsize. Not userland-observable (no behavioral delta measurable from userspace; deallocate frees the whole object regardless), so no guest reproduction is possible - confirmed by inspection only. Latent trap for any future consumer trusting aobj->size after truncate; line identical in DragonFly master.
Kernel references
Fix
See fix.diff.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md + run.log + sources
PoC changes
none
Verified recommended fix
diff --git a/sys/vfs/tmpfs/tmpfs_subr.c:1058: aobj->size = nsize;
Verdict
Line-verified dead store: tmpfs_subr.c:1058 writes osize (loaded from aobj->size at :1055) back into aobj->size - a no-op; the surrounding cleanup (swap_pager_freespace/vm_object_page_remove over [nsize, osize)) shows the intent was aobj->size = nsize. Not userland-observable (no behavioral delta measurable from userspace; deallocate frees the whole object regardless), so no guest reproduction is possible - confirmed by inspection only. Latent trap for any future consumer trusting aobj->size after truncate; line identical in DragonFly master.
No comments yet.