mirror of
https://github.com/opnsense/src.git
synced 2026-07-15 20:13:02 -04:00
6c203aa76c
sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies <chrisjd@openai.com> Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 |
||
|---|---|---|
| .. | ||
| _vm_phys.h | ||
| _vm_radix.h | ||
| device_pager.c | ||
| memguard.c | ||
| memguard.h | ||
| phys_pager.c | ||
| pmap.h | ||
| redzone.c | ||
| redzone.h | ||
| sg_pager.c | ||
| swap_pager.c | ||
| swap_pager.h | ||
| uma.h | ||
| uma_align_mask.h | ||
| uma_core.c | ||
| uma_dbg.c | ||
| uma_dbg.h | ||
| uma_int.h | ||
| vm.h | ||
| vm_domainset.c | ||
| vm_domainset.h | ||
| vm_dumpset.h | ||
| vm_extern.h | ||
| vm_fault.c | ||
| vm_glue.c | ||
| vm_init.c | ||
| vm_kern.c | ||
| vm_kern.h | ||
| vm_map.c | ||
| vm_map.h | ||
| vm_meter.c | ||
| vm_mmap.c | ||
| vm_object.c | ||
| vm_object.h | ||
| vm_page.c | ||
| vm_page.h | ||
| vm_pageout.c | ||
| vm_pageout.h | ||
| vm_pagequeue.h | ||
| vm_pager.c | ||
| vm_pager.h | ||
| vm_param.h | ||
| vm_phys.c | ||
| vm_phys.h | ||
| vm_radix.c | ||
| vm_radix.h | ||
| vm_reserv.c | ||
| vm_reserv.h | ||
| vm_swapout.c | ||
| vm_unix.c | ||
| vnode_pager.c | ||
| vnode_pager.h | ||