d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not pass bogus page to mbufs.

Browse Source 
This is a bug in r359473.

Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
This commit is contained in:
Konstantin Belousov 2020-04-10 01:28:47 +00:00
parent 71f2642988
commit f709eee61a
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/kern/kern_sendfile.c
View File

@ -649,6 +649,7 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
struct file *sock_fp;
struct vnode *vp;
struct vm_object *obj;
vm_page_t pga;
struct socket *so;
#ifdef KERN_TLS
struct ktls_session *tls;
@ -948,6 +949,9 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
softerr = EBUSY;
break;
}
pga = pa[i];
if (pga == bogus_page)
pga = vm_page_relookup(obj, sfio->pindex0 + i);
if (use_ext_pgs) {
off_t xfs;
@ -997,7 +1001,7 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
ext_pgs->nrdy++;
}
ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pa[i]);
ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pga);
ext_pgs->npgs++;
xfs = xfsize(i, npages, off, space);
ext_pgs->last_pg_len = xfs;
@ -1016,7 +1020,7 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
* threads might exhaust the buffers and then
* deadlock.
*/
sf = sf_buf_alloc(pa[i],
sf = sf_buf_alloc(pga,
m != NULL ? SFB_NOWAIT : SFB_CATCH);
if (sf == NULL) {
SFSTAT_INC(sf_allocfail);