swap_pager_getpages(): assert that bp->b_pages[] is accessed in bounds

Reviewed by:	glebius, markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D54713

This commit is contained in:

Konstantin Belousov

2026-01-11 13:04:01 +02:00

parent 3fe275c1ef

commit b02ddb59e6

1 changed files with 3 additions and 0 deletions

									
										sys/vm/swap_pager.c
									
		+3
		
												View File
												
				@@ -1396,6 +1396,9 @@ swap_pager_getpages_locked(struct pctrie_iter *blks, vm_object_t object,

					vm_object_prepare_buf_pages(object, bp->b_pages, count, &rbehind,

					    &rahead, ma);

					bp->b_npages = rbehind + count + rahead;

					KASSERT(bp->b_npages <= PBUF_PAGES,

					    ("bp_npages %d (rb %d c %d ra %d) not less than PBUF_PAGES %jd",

					    bp->b_npages, rbehind, count, rahead, (uintmax_t)PBUF_PAGES));

					for (int i = 0; i < bp->b_npages; i++)

						bp->b_pages[i]->oflags |= VPO_SWAPINPROG;

					bp->b_blkno = swp_pager_meta_lookup(blks, pindex - rbehind);