posixshm: Fix handling of sendfile() with largepage objects

sendfile(2) can transmit POSIX shared memory objects.  Typically it will
look up and wire each page before sending it to a socket; once
transmission is complete, the page is unwired and typically released
back into the page queues.  sendfile() has an advisory flag, SF_NOCACHE,
which means, "try to free the page once transmission is complete."  This
is implemented in vm_page_release(), which expects to operate on managed
pages.

Pages belonging a largepage object are de-facto wired not explicitly so.
Thus, vm_page_release() will unwire and, having found no additional
references, free the page.  Because mappings of largepage objects are
unmanaged, userspace can still access the now freed page.

Fix the problem by explicitly wiring largepage pages.  Make the VM
object destructor responsible for unwiring and freeing them.

Add a regression test.

Approved by:	so
Security:	FreeBSD-SA-26:44.posixshm
Security:	CVE-2026-49427
Reported by:	Chris Jarrett-Davies <chrisjd@openai.com>
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D57832

0 files changed, 0 insertions, 0 deletions