The branch main has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=9a1b3303352beb44d48b8251b80656a316b7a2e9
commit 9a1b3303352beb44d48b8251b80656a316b7a2e9
Author: Mark Johnston <ma...@freebsd.org>
AuthorDate: 2025-08-01 23:34:46 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2025-08-04 14:27:26 +0000
vm_page: Clear VM_ALLOC_NOCREAT in vm_page_grab_pflags()
Otherwise vm_page_grab_zero_partial() and vm_page_grab_pages() can pass
it to vm_page_alloc_*(), which results in an assertion failure since
that flag is meaningless when allocating a page:
panic: invalid request 0x8400
cpuid = 0
time = 1754074745
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x49/frame
0xfffffe00542859c0
vpanic() at vpanic+0x1ea/frame 0xfffffe0054285b00
panic() at panic+0x43/frame 0xfffffe0054285b60
vm_page_alloc_domain_iter() at vm_page_alloc_domain_iter+0x720/frame
0xfffffe0054285be0
vm_page_grab_zero_partial() at vm_page_grab_zero_partial+0x1d4/frame
0xfffffe0054285c90
shm_fspacectl() at shm_fspacectl+0x1cd/frame 0xfffffe0054285d30
kern_fspacectl() at kern_fspacectl+0x49f/frame 0xfffffe0054285db0
sys_fspacectl() at sys_fspacectl+0x5b/frame 0xfffffe0054285e00
amd64_syscall() at amd64_syscall+0x29c/frame 0xfffffe0054285f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0054285f30
Reported by: syzkaller
Reviewed by: alc, kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D51692
---
sys/vm/vm_page.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c
index d3772af3c284..abad5efb8a79 100644
--- a/sys/vm/vm_page.c
+++ b/sys/vm/vm_page.c
@@ -4717,7 +4717,7 @@ vm_page_grab_pflags(int allocflags)
pflags = allocflags &
~(VM_ALLOC_NOWAIT | VM_ALLOC_WAITOK | VM_ALLOC_WAITFAIL |
- VM_ALLOC_NOBUSY | VM_ALLOC_IGN_SBUSY);
+ VM_ALLOC_NOBUSY | VM_ALLOC_IGN_SBUSY | VM_ALLOC_NOCREAT);
if ((allocflags & VM_ALLOC_NOWAIT) == 0)
pflags |= VM_ALLOC_WAITFAIL;
if ((allocflags & VM_ALLOC_IGN_SBUSY) != 0)
