Re: kern/58552: panic via genfs_getpages - ufs_bmaparray

[gnats-admin%netbsd.org@localhost]

The following reply was made to PR kern/58552; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: "J. Hannken-Illjes" <hannken%mailbox.org@localhost>
Cc: "S.P.Zeidler" <spz%NetBSD.org@localhost>,
	gnats-bugs%NetBSD.org@localhost, netbsd-bugs%NetBSD.org@localhost
Subject: Re: kern/58552: panic via genfs_getpages - ufs_bmaparray
Date: Fri, 30 Aug 2024 01:09:02 +0000

 > Date: Thu, 29 Aug 2024 11:25:59 +0200
 > From: "J. Hannken-Illjes" <hannken%mailbox.org@localhost>
 > 
 > All these entrys are valid "struct vm_page *" pointers so it looks like
 > this page allocated to the "bufpl" got overwritten with 512 pointers
 > to vm pages.
 > 
 > Which operation creates an array of at least 512 "struct vm_page"
 > pointers and therefore is a candidate for trashing?
 
 genfs_getpages potentially does this, say for fsync or msync of a 2MB
 range:
 
     308 	const int pgs_size = sizeof(struct vm_page *) *
     309 	    ((endoffset - startoffset) >> PAGE_SHIFT);
     310 	struct vm_page **pgs, *pgs_onstack[UBC_MAX_PAGES];
     311 
     312 	if (pgs_size > sizeof(pgs_onstack)) {
     313 		pgs = kmem_zalloc(pgs_size, async ? KM_NOSLEEP : KM_SLEEP);
 
 https://nxr.netbsd.org/xref/src/sys/miscfs/genfs/genfs_io.c?r=1.104#308