Re: kern/58552: panic via genfs_getpages - ufs_bmaparray

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

> Date: Thu, 29 Aug 2024 11:25:59 +0200
> From: "J. Hannken-Illjes" <hannken%mailbox.org@localhost>
> 
> All these entrys are valid "struct vm_page *" pointers so it looks like
> this page allocated to the "bufpl" got overwritten with 512 pointers
> to vm pages.
> 
> Which operation creates an array of at least 512 "struct vm_page"
> pointers and therefore is a candidate for trashing?

genfs_getpages potentially does this, say for fsync or msync of a 2MB
range:

    308 	const int pgs_size = sizeof(struct vm_page *) *
    309 	    ((endoffset - startoffset) >> PAGE_SHIFT);
    310 	struct vm_page **pgs, *pgs_onstack[UBC_MAX_PAGES];
    311 
    312 	if (pgs_size > sizeof(pgs_onstack)) {
    313 		pgs = kmem_zalloc(pgs_size, async ? KM_NOSLEEP : KM_SLEEP);

https://nxr.netbsd.org/xref/src/sys/miscfs/genfs/genfs_io.c?r=1.104#308