Re: sys/uvm: fix uao_dropswap() index typo

Mark Kettenis <[email protected]> Wed, 22 Jul 2026 22:28:23 +0200
Newsgroups gmane.os.openbsd.tech
Message-ID <[email protected]>
> Date: Wed, 22 Jul 2026 20:48:47 +0200
> From: Kirill A. Korinsky <[email protected]>
> 
> tech@,
> 
> the loop variable indexes the current pgs[] batch, not the page within the
> object. Pass the fetched page's object offset to uao_dropswap(), as the
> other resident page callers do.
> 
> Thoughts? Ok?

Good find.  Trying to think about what the consequences would be of
this bug.  I guess bad things may happen if we partially wire down an
object and then unwire it again.  Some other pages in the object will
get their swap dropped if they're swapped out.

Probably doesn't happen a lot.  Possibly cuases corruption of GPU
memory?

ok kettenis@

> Index: sys/uvm/uvm_object.c
> ===================================================================
> RCS file: /home/cvs/src/sys/uvm/uvm_object.c,v
> diff -u -p -r1.28 uvm_object.c
> --- sys/uvm/uvm_object.c	10 Dec 2025 08:38:18 -0000	1.28
> +++ sys/uvm/uvm_object.c	22 Jul 2026 14:31:58 -0000
> @@ -156,7 +156,7 @@ uvm_obj_wire(struct uvm_object *uobj, vo
>  			if (pgs[i]->pg_flags & PQ_AOBJ) {
>  				atomic_clearbits_int(&pgs[i]->pg_flags,
>  				    PG_CLEAN);
> -				uao_dropswap(uobj, i);
> +				uao_dropswap(uobj, pgs[i]->offset >> PAGE_SHIFT);
>  			}
>  		}
>  
> 
> -- 
> wbr, Kirill
> 
>