git: d8dfbeb57017 - main - uiomove_object_page: a failed copy can still dirty the page

The branch main has been updated by alc:

URL: https://cgit.FreeBSD.org/src/commit/?id=d8dfbeb5701769832e84e5bb52f2e8b4e3ab902b

commit d8dfbeb5701769832e84e5bb52f2e8b4e3ab902b
Author:     Alan Cox <alc@FreeBSD.org>
AuthorDate: 2026-10-03 17:19:36 +0000
Commit:     Alan Cox <alc@FreeBSD.org>
CommitDate: 2026-10-06 04:30:23 +0000

    uiomove_object_page: a failed copy can still dirty the page
    
    For writes, if we fail in the middle of reading from the source, the
    destination may have already been dirtied.  For example, the source may
    cross a page boundary, and the second page is inaccessible.
    Conservatively mark the destination as dirty, even on errors.
    
    Reported by:    Claude (Opus 5.5)
    Reviewed by:    kib, markj
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D60280
---
 sys/kern/uipc_shm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c
index 7df9d59716c7..3544ebd35336 100644
--- a/sys/kern/uipc_shm.c
+++ b/sys/kern/uipc_shm.c
@@ -246,8 +246,14 @@ uiomove_object_page(vm_object_t obj, size_t len, struct uio *uio)
 
 found:
 	error = uiomove_fromphys(&m, offset, tlen, uio);
-	if (uio->uio_rw == UIO_WRITE && error == 0)
+	if (uio->uio_rw == UIO_WRITE) {
+		/*
+		 * Even a failed copy may have changed the page's contents,
+		 * because uiomove_fromphys() can copy part of the data before
+		 * it fails.
+		 */
 		vm_page_set_dirty(m);
+	}
 	vm_page_activate(m);
 	vm_page_sunbusy(m);