DF-5813

Four more raw vm_page_t-pointer kprintfs on attacker-triggerable pagedaemon race-recovery paths (rebusy A/B/C and the scan_cache find/busy warning) disclose kernel heap addresses into the world-readable msgbuf

Summary

vm_pageout_page prints 'rebusy %p failed(A)/(B)/(C)' when a page moved queues/objects/handle, became invalid, or was cleaned by a competing flush across its blocking vget window (:1340/:1350/:1356); vm_pageout_scan_cache prints 'WARNING! page race during find/busy: %p' (:1728). All four leak a raw vm_page_t (vm_page_array address) plus page state to the console/msgbuf readable by any local user (dmesg world-executable, verified). Same class as DF-2689 but four distinct sites; strings verified present in the running guest kernel. Honest verdict: NOT reproduced — 8 runs / 5 rig designs / ~25 min under verified daemon pressure (1862 wakeups, 1.31M pages examined) never fired; vm.pageout_lock_miss stayed 0 — the guarded interleavings are empirically rare on this fast-disk guest. Defect stands by inspection; full rig history retained for re-testing on slower/busier hardware. Delete-the-kprintfs fix git-apply-clean.

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — virtual memory
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-532
File: sys/vm/vm_pageout.c
Lines: 1340-1728
Area: vm
Discovered: 2026-10-13
Updated: 2026-10-13

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: likely
Tested: 2026-10-13 03:55:16
Attempts: 8
Runtime: 1500s
Code hash: 943ed63d578d4406
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cc -O2 -o df5813_leakstress df5813_leakstress.c -lpthread
Run cmd: ./df5813_leakstress <workdir> <seconds> <hog_MB> ; dmesg | grep -E 'rebusy|page race during find/busy'

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: likely
Tested: 2026-10-13 03:55:16
Runtime: —
Kernel: per-fix-DF-5813
fix.diff: findings/poc/DF-5813/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-5813 · 9 files

File	Type	Size
df5813_leakstress.c	—	5.8 KB	view raw
build.sh	—	112 B	view raw
run.sh	—	182 B	view raw
build.log	—	183 B	view raw
run.log	—	1.2 KB	view raw
strings_check.txt	—	447 B	view raw
fix.diff	—	1.0 KB	view raw
verdict.json	—	3.6 KB	view raw
README.md	—	2.7 KB	↓ raw

README.md

↓ download raw

DF-5813 — four more raw-kernel-pointer kprintfs on pagedaemon race-recovery paths

Finding: vm_pageout_page() and vm_pageout_scan_cache() print raw vm_page_t pointers (physmap/vm_page_array addresses) plus page state to the console/msgbuf on race-recovery paths:

sys/vm/vm_pageout.c:1340 — vm_pageout_page: rebusy %p failed(A) (page moved queues / changed object / vnode handle changed across the blocking vget() window),
sys/vm/vm_pageout.c:1350 — ... failed(B) (page became invalid),
sys/vm/vm_pageout.c:1356 — ... failed(C) (page was cleaned by a competing flush during vget()),
sys/vm/vm_pageout.c:1728 — WARNING! page race during find/busy: %p queue == %d dirty=%02x (PQ_CACHE page raced between vm_page_list_find() and vm_page_busy_try()).

Sibling of DF-2689 (which covers only the scan_hold print at :1932).

Verification verdict: not_reproduced (race never fired on this guest)

Verified on the guest (DragonFly 6.5-DEVELOPMENT #0, X86_64_GENERIC):

All four format strings ARE in the running kernel: strings /boot/kernel/kernel | grep -E 'failed\((A|B|C)\)|page race during find|HOLD->FREE' → 1/1/1/1.
The msgbuf is world-readable by an unprivileged user (test/maxx uid 1001/1002 ran /sbin/dmesg successfully) — so when the prints fire, the pointer is disclosed to any local user.
Five adversarial stress rigs (~25 min wall, ~2 GB/s of vnode-page churn under sustained pagedaemon pressure) did NOT hit the races: - v1: mmap+msync(MS_ASYNC)+madvise churn + ftruncate + 2.3 GB anon hog - v2: 6–8 files × writers/syncer(MS_SYNC+MS_INVALIDATE)/cacher + hogs - v3: persistent dirty RW maps (writers never clean) + 1.4 GB hog - v4: dirty-then-ABANDON cycling (WINATCFLS state machine) + 2.6 GB hog - file placement on UFS (/boot) and HAMMER2 (/), hog 500–2700 MB During the rigs the pagedaemon was demonstrably active (1862 wakeups, 1.31 M pages examined, 295 k pages freed by daemon, vnode putpages counter +60 k) — but vm.pageout_lock_miss stayed 0 (the daemon's vget() in the laundering branch never even timed out on this fast-disk single-tenant guest) and none of the four prints fired.

Conclusion: the disclosure is certain by inspection (the prints are unconditional on their paths and dmesg is world-readable), but the guarded interleavings are empirically rare on this hardware; the PoC is recorded as not_reproduced rather than claimed without a firing.

Files

df5813_leakstress.c — v4 trigger (final; see header for design notes)
build.sh / run.sh
run.log — decisive rig run output (v4, 300 s, markers stayed 0)
strings_check.txt — kernel-binary + dmesg-permission verification
verdict.json — machine verdict

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

No kernel fix-build performed: finding did not reproduce (race too rare on this guest) and severity is Info; fix is a one-line kprintf removal validated by inspection.

fix.diff authored against sys/vm/vm_pageout.c (not applied to sys/).

↓ fix.diffper-fix-DF-5813

Confirmed kernel references

Detail

Evidence (decisive lines)

['findings/poc/DF-5813/strings_check.txt — all 4 format strings in /boot/kernel/kernel; unprivileged dmesg works', 'findings/poc/DF-5813/run.log — 5 rig designs, all runs markers=0, pageout_lock_miss=0', 'sys/vm/vm_pageout.c:1262-1359 — the vget window and the (A)/(B)/(C) recovery prints', 'sys/vm/vm_pageout.c:1727-1731 — the scan_cache find/busy race print', 'README.md — design rationale for why each rig targeted a specific print']

PoC changes

v1 crashed on ftruncate-beyond-EOF shared maps (SIGSEGV/SIGBUS); replaced truncation with msync(MS_INVALIDATE). v2/v3 kept pages too clean or too referenced to be deactivated; v4 implements dirty-then-ABANDON cycling so pages reach the daemon's WINATCFLS laundering branch while a syncer competes as cleaner.

Verified recommended fix

Delete the four kprintfs or strip the %p (keep a counter); mirrors the DF-2689 fix for :1932.

Verdict

The four pointer-printing kprintfs (vm_pageout.c:1340/1350/1356 'rebusy %p failed(A|B|C)' in vm_pageout_page() and :1728 'WARNING! page race during find/busy: %p' in vm_pageout_scan_cache()) are certain by inspection and verified present in the running guest kernel (strings check), and the msgbuf is world-readable by unprivileged users (verified: uid 1001/1002 ran /sbin/dmesg). However the guarded interleavings never fired on this guest: five adversarial stress-rig designs over ~25 minutes (mmap dirty/msync/madvise/ftruncate churn, persistent dirty maps, dirty-then-abandon WINATCFLS cycling, UFS and HAMMER2 targets, anon hogs 500-2700MB) kept the pagedaemon demonstrably busy (1862 wakeups, 1.31M pages examined, 295k freed, vnode putpages +60k) yet vm.pageout_lock_miss stayed 0 and no marker line ever appeared in dmesg. The defect (raw vm_page_t pointer disclosure on race-recovery paths, sibling of DF-2689 at :1932) stands as Info severity; the race is empirically rare on this fast-disk single-tenant guest, so the PoC is honestly recorded as not_reproduced with the full rig history for future re-testing on busier hardware.