posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handlerHEADmain

The check for whether shm_lp_psind was assigned was unlocked.  This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated.  This in turn can be used to
escalate privileges.

Fix this by acquiring the rangelock earlier.  In shm_mmap_large(),
assert that we hold the rangelock.  In shm_write(), annotate an unlocked
load of shm_lp_psind.

Approved by:	so
Security:	FreeBSD-SA-26:63.posixshm
Security:	CVE-2026-58094
Reported by:	tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D59104

0 files changed, 0 insertions, 0 deletions