From nobody Thu Oct 01 15:20:25 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hwbFj5Lypz6v5J4 for ; Thu, 01 Oct 2026 15:20:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hwbFj3hZHz4KSf for ; Thu, 01 Oct 2026 15:20:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790868025; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i/S00j3r2eaSHn6jLGCOhOJSdxD6Phf3maY5TkInUC4=; b=pENeOaSXqpDX3Iom3z1S8yeU0F9B9P9xt5Nl+lKuWcd+8IV7NjcLsg0O/B1LFp5V2wEOem WDljXTIdk7ZpvgibHMRQSyms1g7ug3WM2xuAS93QU/2j+OVqCqo23bs+iQxeW6rv4nz4hT DL7jg+coIdRn4ohvGJ/xHpLyptExKQsPf67UluOWxUiitk5Rah40sc+GBUDwL1IK9gFGVf ATY7EyEA73o0VPydBRKOdIOiL9IEb3PJO2siwhVR9KHmSxf61QP1nGIgBHCGumyZK7HTZB TLv7wApi+3iNd2zR3CJHp7B87fFV3ICKbD+xRZJqJH7VjXtGNlE4rnuT6rCH6Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790868025; b=m8zu2Csj5/dB1Dj367NZKHIo1qAJE2awhGzJgvbCTAAiCsNIhS1+LytJ6qK10t5Y3e3DIb HlVxj9KMcca6EjSeV3hcVy5EHpme3r4yF3PgZqPlqORjmqyDtZs9xhHuALHvvu3/TjliAl 0Pa/fRdRJlj1tTdZA4q3kzRPRw246OPQjG5tDl9Gq/NJmcsRy0+9gAoxGH0/yC9yG0W7pq dfg7gJ/R+o7mtpUfT4+abdMKUUVHwB/0FOAR4yDpMjMGUQo5ve5gzdNSk8vs5mrfBoYG2d iBWxqZ+0El1FhUoGt6Yn+EQomPh6VqI8dvosdP5a/GXSa52uP3dMYRaHAJLyTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790868025; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i/S00j3r2eaSHn6jLGCOhOJSdxD6Phf3maY5TkInUC4=; b=jtFNPfX9hfXbupzWEASoqaq0wZA5+JSoch46vRZAYyP+nE6eNM4dz0AjArgIFWAV3e8xdt M50R2eEVpcvsBhrI+LeNrjwv+W9WgkFR+pdDc8ZQ83/EnFhU4jF4l6k0/QrmQMsF4o6xlm L3OXUT0CmLXsIV/PG5uc4cI3W//S0N2kI2E1mqcrvXUwcClTYPPqkUArTSTzbKlSwAGK1B eM4B/45ldnr5vlH7AimegMRLyFYvfj8pRwCm7sYhFiorDjmfhxWoMZO43FulZA9IEivz8A RU/C0GD0a6pXQRClkRDGbwKHRlBaz+1sGWzC2jJsFTJMkJ1qCO0Kxt5QNaGAwg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hwbFj2m2nzdBG for ; Thu, 01 Oct 2026 15:20:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3be36 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 01 Oct 2026 15:20:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: ce4ece145cec - stable/15 - vm_page: Fix the error path in vm_page_alloc_contig_domain() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ce4ece145cec5f38ee0c91f05e82a414eb1aa1ba Auto-Submitted: auto-generated Date: Thu, 01 Oct 2026 15:20:25 +0000 Message-Id: <6abe7a39.3be36.5e2da413@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ce4ece145cec5f38ee0c91f05e82a414eb1aa1ba commit ce4ece145cec5f38ee0c91f05e82a414eb1aa1ba Author: Mark Johnston AuthorDate: 2026-09-24 15:49:37 +0000 Commit: Mark Johnston CommitDate: 2026-10-01 13:42:31 +0000 vm_page: Fix the error path in vm_page_alloc_contig_domain() If we are inserting a run of pages into a VM object and fail at some point due to a memory allocation failure, we have to free all of the pages in the run. We do that by resetting some fields and calling vm_page_free_toq() on each page; this removes the page from the object and frees it back to the buddy allocator. If the page is supposed to be wired, we reset the reference count, but this was done incorrectly: the VPRC_OBJREF flag must be retained as the page still belongs to an object. Resetting it to zero will cause a panic in vm_page_free_prep(): vm_page_free_object_prep() will subtract VPRC_OBJREF from the refcount, causing underflow, and vm_page_free_prep() subsequently calls panic() if the refcount is non-zero. Reviewed by: alc, kib Fixes: fee2a2fa3983 ("Change synchonization rules for vm_page reference counting.") MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59908 (cherry picked from commit 742e58ddc989563f90a1d636cb29793641784ca1) --- sys/vm/vm_page.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index ce5748bd5f33..2f47cb7a3104 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -2417,7 +2417,7 @@ vm_page_alloc_contig_domain(vm_object_t object, vm_pindex_t pindex, int domain, for (m = m_ret; m < &m_ret[npages]; m++) { if (m <= mpred && (req & VM_ALLOC_WIRED) != 0) - m->ref_count = 0; + m->ref_count = VPRC_OBJREF; m->oflags = VPO_UNMANAGED; m->busy_lock = VPB_UNBUSIED; /* Don't change PG_ZERO. */