In vm_fault_copy_entry(), we should not assert that entry is charged
if the dst_object is not of swap type. It can only happen when entry does not require copy, otherwise vm_map_protect() already adds the charge. So the assert was right for the case where swap object was allocated in the vm_fault_copy_entry(), but not when it was just copied from src_entry and its type is not swap. Reported by: andrew using syzkaller Reviewed by: alc Sponsored by: The FreeBSD Foundation Approved by: re (gjb) MFC after: 1 week Differential revision: https://reviews.freebsd.org/D17323
This commit is contained in:
parent
a60d3db15e
commit
9f25ab83f9
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=338998
@ -1650,7 +1650,9 @@ vm_fault_copy_entry(vm_map_t dst_map, vm_map_t src_map,
|
||||
dst_object->cred = curthread->td_ucred;
|
||||
crhold(dst_object->cred);
|
||||
*fork_charge += dst_object->charge;
|
||||
} else if (dst_object->cred == NULL) {
|
||||
} else if ((dst_object->type == OBJT_DEFAULT ||
|
||||
dst_object->type == OBJT_SWAP) &&
|
||||
dst_object->cred == NULL) {
|
||||
KASSERT(dst_entry->cred != NULL, ("no cred for entry %p",
|
||||
dst_entry));
|
||||
dst_object->cred = dst_entry->cred;
|
||||
|
Loading…
Reference in New Issue
Block a user