HomeFreeBSD

Fix a use-after-free in swp_pager_meta_free().

Description

Fix a use-after-free in swp_pager_meta_free().

This was introduced in r326329 and explains the crashes mentioned in
the commit log message for r339934. In particular, on INVARIANTS
kernels, UMA trashing causes the loop to exit early, leaving swap
blocks behind when they should have been freed. After r336984 this
became more problematic since new anonymous mappings were more
likely to reuse swapped-out subranges of existing VM objects, so faults
would trigger pageins of freed memory rather than returning zeroed
pages.

Reviewed by: kib
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D17897

Details

Provenance
markjAuthored on
Reviewer
kib
Differential Revision
D17897: Fix a use-after-free in swp_pager_meta_free().
Parents
rS340240: loader: ptable_open() check for ptable_cd9660read result is wrong
Branches
Unknown
Tags
Unknown