From nobody Thu Oct 29 17:30:52 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFrqJ30Ggz6xMdJ for ; Thu, 29 Oct 2026 17:30:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFrqJ0y8sz4vnW for ; Thu, 29 Oct 2026 17:30:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793295052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5X/nx8F+BtNLGnBVaIdm7tDUYvtrU4vZS2T1KDdBG8k=; b=wLVkDfqBC23C6UpRU8BNU4PRQFsJxxpqC6/ASISe18qjMx5vhqL+Esa0vsIhx9+X1uyceZ MlSB/E6HmEaxC0phOeAo9Uc8ZFGb90hnlKHunCeDLUlEt3xpmD28ULBPbrOMsGy3Z14SnH TAv5Pg60JJY/A2AhGsAyRWUxuyT4zFEelS9EiJ4Vg/qYAGJ0m8uCbhfKX4eTymWr7B/3y8 o+Js9JVJFompKv9Wng8fcJsL+FCT31+64f8pdjOXMXWPeF/issFmwkb5asH/do5s3qrDm+ vyz0Losk5Bkp+Lurfh2zKjsEL2QAZZqVD/mPbMTwkxFkDqVGBgII3bWP8NC0Jg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793295052; b=kPHxOy5dTCeA2w/7CUrfJUOPF45H0+eW80C/uv7dSm4jS1ZAV1x0mS94mjuQQ4ixh5CQtA BD2bbpJ65MKuW8sD5r38fICIY4jyv6xPDpM+wK4P86EJMM39QGYjmp4eswdReZ4YW5YoVv z27Uh8mKO0TuNuGtub1xioruwGTG72a5amOWPlcHxqTQGebHzyfKjNt3eU/DZyGgZY4PDk u5t2lEOPmSUXIaGvvtquEo6+vMS4vtUQmGNus46AyBBu8yit/bmYriKB/9piDB0Cl7bZqc nVS+B9NQqy2Fy/hN0U4IIuodzyk4NCZ8wqWhib8dij7SRA97Jc9cpH+30Dc1ag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793295052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5X/nx8F+BtNLGnBVaIdm7tDUYvtrU4vZS2T1KDdBG8k=; b=k3kXiAnFRLy1E0W4xr9qJaj1anHbBGFD0tdGexaffsS+cz4IQl/5AY5TPrHdYaSNHqaGf7 eCyup3+CpghBaegkhEPzVO88k0AU2nlKcJUNtYo003MZ2Se/dQ6S0otiCCfLOBEMO7d/th QHV+BaTaWhmgygWXhyy/R2KD9YHLNHkE1UhKiO+mREByty4JFc8H3hl0ai2HvElM2RSRMn YRoYImjisjqi8h0XwRIjBEXL6/e3hX2qUoBMRNgOyztOqtkQikQ9olHDKpcM+5cQVRVm09 FktcRbOs/cOzCaAjvJEEuhR9hyXMyYiogBbQzaTBuAl9OvMzL1Srr4UOCkmASg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFrqJ0ClmzqDq for ; Thu, 29 Oct 2026 17:30:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3cdb3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 17:30:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Wanpeng Qian From: Mark Johnston Subject: git: 710a12b355fd - main - vm_kern: wrap around in kmem_back() when the last domain is empty List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 710a12b355fd985eec0f2a85626480c636f5468b Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 17:30:52 +0000 Message-Id: <6ae382cc.3cdb3.4084ff15@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=710a12b355fd985eec0f2a85626480c636f5468b commit 710a12b355fd985eec0f2a85626480c636f5468b Author: Wanpeng Qian AuthorDate: 2026-10-29 17:27:04 +0000 Commit: Mark Johnston CommitDate: 2026-10-29 17:27:11 +0000 vm_kern: wrap around in kmem_back() when the last domain is empty kmem_back() picks the domain from the address and, when that domain has no memory, steps forward until it finds one that does: domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains; while (VM_DOMAIN_EMPTY(domain)) domain++; Nothing stops the walk at vm_ndomains. When the empty domain is the last one, the loop runs through the unused tail of vm_dom[] (all empty) and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word there happens to look like a non-zero page count; kmem_back_domain() then allocates from that garbage domain. Ordinary allocations never get here, because the per-domain arenas and the domainset iterators skip empty domains. Only the direct callers of kmem_back() do: kinst (one trampoline per thread, allocated when the module loads) and memguard. Signed-off-by: Wanpeng Qian Reviewed by: kib, markj Sponsored by: keelos.dev MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60935 --- sys/vm/vm_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/vm/vm_kern.c b/sys/vm/vm_kern.c index 41ba07373976..50d0aa2d61d3 100644 --- a/sys/vm/vm_kern.c +++ b/sys/vm/vm_kern.c @@ -637,7 +637,7 @@ kmem_back(vm_object_t object, vm_offset_t addr, vm_size_t size, int flags) if (vm_ndomains > 1) { domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains; while (VM_DOMAIN_EMPTY(domain)) - domain++; + domain = (domain + 1) % vm_ndomains; next = roundup2(addr + 1, KVA_QUANTUM); if (next > end || next < start) next = end;