NetBSD Problem Report #60601

From www@netbsd.org  Sun Aug 16 06:41:23 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A5A5F1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 16 Aug 2026 06:41:23 +0000 (UTC)
Message-Id: <20260816064122.5CD511A923C@mollari.NetBSD.org>
Date: Sun, 16 Aug 2026 06:41:22 +0000 (UTC)
From: hashimoto.kenichi@genetec.co.jp
Reply-To: hashimoto.kenichi@genetec.co.jp
To: gnats-bugs@NetBSD.org
Subject: tmpfs size calculation overflows on 32-bit ports when memory plus swap exceeds 4GB
X-Send-Pr-Version: www-1.0
X-From4GNATS: "hashimoto.kenichi@genetec.co.jp via gnats" <gnats-admin@NetBSD.org>

>Number:         60601
>Category:       kern
>Synopsis:       tmpfs size calculation overflows on 32-bit ports when memory plus swap exceeds 4GB
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 16 06:45:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Wed Oct 07 04:30:02 +0000 2026
>Originator:     Hashimoto Kenichi
>Release:        NetBSD 10.1
>Organization:
genetec corporation
>Environment:
System: NetBSD 10.1 (GENERIC) i386, 2.9GB RAM, 32GB swap (QEMU/NVMM guest)
>Description:
In tmpfs_bytes_max() (sys/fs/tmpfs/tmpfs_mem.c rev 1.8):

	psize_t freepages = tmpfs_mem_info(false);
	uint64_t avail_mem;
	...
	avail_mem = round_page(mp->tm_bytes_used) + (freepages << PAGE_SHIFT);

The shift is evaluated in the width of psize_t before the addition.
On i386 without PAE, psize_t is unsigned long, i.e. 32 bits.
tmpfs_mem_info() returns a page count covering main memory and swap,
so once it exceeds 2^20 pages the result wraps modulo 2^32.

Two measurements, df(1) and vmstat(1) run from a single command line:

                        07:23:16        14:29:34        delta
  pages free              24,233         193,815     +169,582
  cached file pages      281,540         157,941     -123,599
  swap pages in use      512,841         515,106       +2,265
  (swap pages          8,421,126, wired 2,827, freetarg 5,461: unchanged)
  ------------------------------------------------------------
  sum                  8,205,770       8,249,488      +43,718
  df -k /tmp Size      4,186,968         148,488   -4,038,480

The input grew by 43,718 pages while the reported size fell by 4GB.
tmpfs_bytes_max() is monotonic in freepages, so this requires
truncation.  The delta matches one crossing of a 2^32 boundary to
within the error of reading swpgavail/swpgonly from vmstat.

This mount has no -s option (size_max=18446744073709551615), so MIN()
always selects the overflowed term.  A -sram%25 mount on the same
system was clamped to the same wrong value.

tmpfs_mem_incr() uses the same function, so this is not only a
reporting problem: build.sh failed with

  fatal error: error writing to /tmp//cc5cFXCC.s: No space left on device

while df reported 100M free on an idle /tmp.

An amd64 system running 11.0 reports expected values, consistent with
psize_t being 64 bits there.  PAE kernels should be unaffected
(untested).  rev 1.7 used size_t, also 32 bits on i386, so this is not
specific to the psize_t change.
>How-To-Repeat:
On a 32-bit port with main memory plus swap exceeding 4GB, mount a
tmpfs without -s and observe over time:

  { date +%T; df -k /tmp; \
    vmstat -s | grep -E 'pages free|cached file pages|swap pages'; }

The reported size does not track the page counts monotonically.
512MB RAM with 5GB swap should suffice but is unverified; the data
above is from a system in production use.

>Fix:
Unknown.

>Release-Note:

>Audit-Trail:
From: =?iso-2022-jp?B?GyRCNjZLXBsoQiAbJEI3ezBsGyhC?=
	<hashimoto.kenichi@genetec.co.jp>
To: "gnats-bugs@NetBSD.org" <gnats-bugs@NetBSD.org>
Cc: 
Subject: Re: kern/60601 (tmpfs size calculation overflows on 32-bit ports when
 memory plus swap exceeds 4GB)
Date: Sun, 16 Aug 2026 06:52:53 +0000

 This PR was submitted twice by accident, and the submitter address on=0A=
 this one is wrong.  Please close this in favour of PR kern/60602,=0A=
 which has the same content and a working reply address.=0A=
 =0A=
 Sorry for the noise.=

State-Changed-From-To: open->needs-pullups
State-Changed-By: kre@NetBSD.org
State-Changed-When: Wed, 07 Oct 2026 04:27:45 +0000
State-Changed-Why:
Needs pullups to -10 and -11

Apologies that this PR (of the two duplicates) is the one that
remained open, while the other was closed - your mail requesting
it be done the other way arrived about 45 seconds too late (60602
had already been closed by then).

Rather than re-open 60602, and close this one, I just fixed the
broken address in this one to be the same as it was in 60601

If you can test this based upon the version in HEAD, please do.


From: "Robert Elz" <kre@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60601 CVS commit: src/sys/fs/tmpfs
Date: Wed, 7 Oct 2026 04:25:09 +0000

 Module Name:	src
 Committed By:	kre
 Date:		Wed Oct  7 04:25:09 UTC 2026

 Modified Files:
 	src/sys/fs/tmpfs: tmpfs_mem.c

 Log Message:
 PR kern/60601 - Avoid 32 bit wraparound on ILP32 hosts

 In tmpfs_bytes_max calculate avail_mem using 64 bit calculations,
 rather than one small piece being 32 bit only (and subject to
 simple overflow, entirely within reasonable values).

 Reported and diagnosed by Hashimoto Kenichi in PR kern/60601

 XXX - pullup -11 -10 (in a week or two).


 To generate a diff of this commit:
 cvs rdiff -u -r1.14 -r1.15 src/sys/fs/tmpfs/tmpfs_mem.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search