CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/06 15:01:30
Modified files:
sys/uvm : uvm_aobj.c
Log message:
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
OK: kettenis@
