d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid unsigned integer overflow which can cause

Browse Source 
rman_reserve_resource_bound() to return incorrect results.

Continue the initial search until the first viable region is found.

Add a comment to explain the search termination test.

PR:		kern/188534
Reviewed by:	jhb (previous version)
MFC after:	1 week
This commit is contained in:
Don Lewis 2014-05-05 15:59:31 +00:00
parent f75b645b40
commit 1237b6d9ed
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=265363
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sys/kern/subr_rman.c
View File

@ -456,7 +456,7 @@ rman_reserve_resource_bound(struct rman *rm, u_long start, u_long end,
mtx_lock(rm->rm_mtx);
for (r = TAILQ_FIRST(&rm->rm_list);
r && r->r_end < start;
r && r->r_end < start + count - 1;
r = TAILQ_NEXT(r, r_link))
;
@ -466,6 +466,11 @@ rman_reserve_resource_bound(struct rman *rm, u_long start, u_long end,
}
amask = (1ul << RF_ALIGNMENT(flags)) - 1;
if (start + amask < start) {
DPRINTF(("start+amask wrapped around\n"));
goto out;
}
/* If bound is 0, bmask will also be 0 */
bmask = ~(bound - 1);
/*
@ -473,11 +478,20 @@ rman_reserve_resource_bound(struct rman *rm, u_long start, u_long end,
*/
for (s = r; s; s = TAILQ_NEXT(s, r_link)) {
DPRINTF(("considering [%#lx, %#lx]\n", s->r_start, s->r_end));
if (s->r_start + count - 1 > end) {
/*
* The resource list is sorted, so there is no point in
* searching further once r_start is too large.
*/
if (s->r_start > end - (count - 1)) {
DPRINTF(("s->r_start (%#lx) + count - 1> end (%#lx)\n",
s->r_start, end));
break;
}
if (s->r_start + amask < s->r_start) {
DPRINTF(("s->r_start (%#lx) + amask (%#lx) wrapped\n",
s->r_start, amask));
break;
}
if (s->r_flags & RF_ALLOCATED) {
DPRINTF(("region is allocated\n"));
continue;