From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Paul Bunn <paul.bunn@icloud.com>
Date: Wed, 4 Mar 2026 00:00:00 +0000
Subject: [PATCH] Add regression test for DSA pagemap overflow in odd-sized segments

When make_new_segment() creates an odd-sized segment (the path taken when
the requested allocation exceeds what fits in a standard-sized segment),
the pagemap array was sized for usable_pages entries rather than
total_pages entries.  Because DSA uses absolute page indices starting at
zero, the last usable pages have indices of metadata_pages + usable_pages
- 1, which can exceed usable_pages - 1 and fall outside the pagemap
array.  This causes out-of-bounds pagemap reads/writes that corrupt user
data.

Add test_dsa_pagemap_overflow() to test_dsa to detect this bug directly.
With 879 usable pages, metadata occupies exactly 2 pages (8192 bytes),
placing pagemap[880] at offset 8192 -- the same offset as the first user
page.  The test allocates 879 pages, extracts the first user page offset
from the returned dsa_pointer, and verifies it lies strictly beyond
pagemap[880].  Before the fix both offsets are 8192 (overlap); after the
fix the user page is at 12288 (3 metadata pages), past pagemap[880].

---
 src/test/modules/test_dsa/expected/test_dsa.out |  6 +++
 src/test/modules/test_dsa/sql/test_dsa.sql      |  1 +
 src/test/modules/test_dsa/test_dsa--1.0.sql     |  4 ++
 src/test/modules/test_dsa/test_dsa.c            | 73 +++++++++++++++++++++++++
 4 files changed, 84 insertions(+)

diff --git a/src/test/modules/test_dsa/expected/test_dsa.out b/src/test/modules/test_dsa/expected/test_dsa.out
index 266010e77fe..ae405946dd7 100644
--- a/src/test/modules/test_dsa/expected/test_dsa.out
+++ b/src/test/modules/test_dsa/expected/test_dsa.out
@@ -11,3 +11,9 @@ SELECT test_dsa_resowners();
  
 (1 row)
 
+SELECT test_dsa_pagemap_overflow();
+ test_dsa_pagemap_overflow 
+---------------------------
+ 
+(1 row)
+
diff --git a/src/test/modules/test_dsa/sql/test_dsa.sql b/src/test/modules/test_dsa/sql/test_dsa.sql
index c3d8db94372..2fd29093a66 100644
--- a/src/test/modules/test_dsa/sql/test_dsa.sql
+++ b/src/test/modules/test_dsa/sql/test_dsa.sql
@@ -2,3 +2,4 @@ CREATE EXTENSION test_dsa;
 
 SELECT test_dsa_basic();
 SELECT test_dsa_resowners();
+SELECT test_dsa_pagemap_overflow();
diff --git a/src/test/modules/test_dsa/test_dsa--1.0.sql b/src/test/modules/test_dsa/test_dsa--1.0.sql
index 2904cb23525..95513b03255 100644
--- a/src/test/modules/test_dsa/test_dsa--1.0.sql
+++ b/src/test/modules/test_dsa/test_dsa--1.0.sql
@@ -10,3 +10,8 @@ CREATE FUNCTION test_dsa_basic()
 CREATE FUNCTION test_dsa_resowners()
 	RETURNS pg_catalog.void
 	AS 'MODULE_PATHNAME' LANGUAGE C;
+
+CREATE FUNCTION test_dsa_pagemap_overflow()
+	RETURNS pg_catalog.void
+	AS 'MODULE_PATHNAME' LANGUAGE C;
+
diff --git a/src/test/modules/test_dsa/test_dsa.c b/src/test/modules/test_dsa/test_dsa.c
index ed2a07c962f..7df34841b3c 100644
--- a/src/test/modules/test_dsa/test_dsa.c
+++ b/src/test/modules/test_dsa/test_dsa.c
@@ -16,6 +16,7 @@
 #include "storage/dsm_registry.h"
 #include "storage/lwlock.h"
 #include "utils/dsa.h"
+#include "utils/freepage.h"
 #include "utils/resowner.h"
 
 PG_MODULE_MAGIC;
@@ -120,3 +121,75 @@ test_dsa_resowners(PG_FUNCTION_ARGS)
 
 	PG_RETURN_VOID();
 }
+
+
+/* DSA-internal constants not exposed in dsa.h, replicated from dsa.c. */
+#if SIZEOF_DSA_POINTER == 4
+#define TEST_DSA_OFFSET_WIDTH 27
+#else
+#define TEST_DSA_OFFSET_WIDTH 40
+#endif
+#define TEST_DSA_OFFSET_BITMASK (((dsa_pointer) 1 << TEST_DSA_OFFSET_WIDTH) - 1)
+#define TEST_DSA_EXTRACT_OFFSET(dp) ((dp) & TEST_DSA_OFFSET_BITMASK)
+
+/*
+ * Test for pagemap overflow into user data in make_new_segment's odd-sized
+ * segment path.
+ *
+ * With 879 usable pages requested, the pagemap starts at offset 1152
+ * (= MAXALIGN(dsa_segment_header) + MAXALIGN(FreePageManager) = 56 + 1096),
+ * so pagemap[880] lands at offset 1152 + 880*8 = 8192.
+ *
+ * Bug:  metadata only spans 2 pages, placing the first user page at offset
+ * 8192 as well -- aliasing pagemap[880] with user data.
+ *
+ * Fix:  metadata is padded to 3 pages, so the first user page moves to
+ * offset 12288, safely past pagemap[880] at 8192.
+ *
+ * BUG:   first user page offset == 8192 (overlaps pagemap[880]).
+ * FIXED: first user page offset == 12288 (no overlap).
+ */
+PG_FUNCTION_INFO_V1(test_dsa_pagemap_overflow);
+Datum
+test_dsa_pagemap_overflow(PG_FUNCTION_ARGS)
+{
+	/*
+	 * pagemap_start is MAXALIGN(dsa_segment_header) + MAXALIGN(FreePageManager)
+	 * = 56 + 1096 = 1152, derived from DSA-internal struct sizes.
+	 */
+	const size_t pagemap_start = 1152;
+	const size_t usable_pages = 879;
+	const size_t pagemap880_offset = pagemap_start + 880 * sizeof(dsa_pointer);
+	int		   *tranche_id;
+	bool		found;
+	dsa_area   *a;
+	dsa_pointer dp;
+	size_t		offset;
+
+	tranche_id = GetNamedDSMSegment("test_dsa", sizeof(int),
+									init_tranche, &found, NULL);
+
+	a = dsa_create(*tranche_id);
+	dp = dsa_allocate(a, usable_pages * FPM_PAGE_SIZE);
+	if (!DsaPointerIsValid(dp))
+		elog(ERROR, "test_dsa_pagemap_overflow: allocation failed");
+
+	/* Extract byte offset of the first user page from the dsa_pointer. */
+	offset = (size_t) TEST_DSA_EXTRACT_OFFSET(dp);
+
+	dsa_free(a, dp);
+	dsa_detach(a);
+
+	/*
+	 * The first user page must begin strictly after pagemap[880].  In the bug
+	 * case both are at 8192; in the fixed case the user page is at 12288.
+	 */
+	if (pagemap880_offset + sizeof(dsa_pointer) > offset)
+		elog(ERROR,
+			 "test_dsa_pagemap_overflow: pagemap[880] (offset %zu, size %zu) "
+			 "overlaps first user page (offset %zu)",
+			 pagemap880_offset, sizeof(dsa_pointer), offset);
+
+	PG_RETURN_VOID();
+}
+
