NetBSD Problem Report #60378

From www@netbsd.org  Sun Jun 28 06:55:02 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 32FF31A923A
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 28 Jun 2026 06:55:02 +0000 (UTC)
Message-Id: <20260628065501.3E8461A923C@mollari.NetBSD.org>
Date: Sun, 28 Jun 2026 06:55:01 +0000 (UTC)
From: kevin.bowling@kev009.com
Reply-To: kevin.bowling@kev009.com
To: gnats-bugs@NetBSD.org
Subject: vga_post_free: unmap and pmap_update before freeing backing pages
X-Send-Pr-Version: www-1.0
X-From4GNATS: "kevin.bowling@kev009.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60378
>Category:       kern
>Synopsis:       vga_post_free: unmap and pmap_update before freeing backing pages
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jun 28 07:00:00 +0000 2026
>Originator:     Kevin Bowling
>Release:        trunk
>Organization:
NetBSD
>Environment:
>Description:
Move pmap_kremove and pmap_update ahead of uvm_pglistfree.
>How-To-Repeat:

>Fix:
diff --git a/sys/arch/x86/x86/vga_post.c b/sys/arch/x86/x86/vga_post.c
index 1b25623ba21e..07f07e21e91b 100644
--- a/sys/arch/x86/x86/vga_post.c
+++ b/sys/arch/x86/x86/vga_post.c
@@ -257,9 +257,9 @@ void
 vga_post_free(struct vga_post *sc)
 {

-       uvm_pglistfree(&sc->ram_backing);
        pmap_kremove(sc->sys_image, 1024 * 1024);
        pmap_update(pmap_kernel());
+       uvm_pglistfree(&sc->ram_backing);
        uvm_km_free(kernel_map, sc->sys_image, 1024 * 1024, UVM_KMF_VAONLY);
        kmem_free(sc, sizeof(*sc));
 }

Home	PR Database Search