d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

There are times when a len==0 parameter to mmap is okay. But on a

Browse Source 
32-bit machine, a len parameter just a few bytes short of 4G, rounded
up to a page boundary and hitting zero then, is not okay. Return
failure in that case.

Reported by: pho
Reviewed by: alc, kib (mentor)
Tested by: pho
Differential Revision: https://reviews.freebsd.org/D20580
This commit is contained in:
Doug Moore 2019-06-10 03:07:10 +00:00
parent c851fce6d7
commit 97220a279f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=348843
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/vm/vm_mmap.c
View File

@ -257,7 +257,10 @@ kern_mmap(struct thread *td, uintptr_t addr0, size_t size, int prot, int flags,
/* Adjust size for rounding (on both ends). */
size += pageoff; /* low end... */
size = (vm_size_t) round_page(size); /* hi end */
/* Check for rounding up to zero. */
if (round_page(size) < size)
return (EINVAL);
size = round_page(size); /* hi end */
/* Ensure alignment is at least a page and fits in a pointer. */
align = flags & MAP_ALIGNMENT_MASK;