From 2a016de1a5abdf87ae6e00f879a3600d157a8ca2 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Mon, 20 Mar 2017 05:15:55 +0000 Subject: [PATCH] Use IDX_TO_OFF(), not ptoa(), when converting the difference between two vm_pindex_t's into a vm_ooffset_t. The length given to shm_dotruncate() must never be negative. Assert this. Tidy up a comment. Reviewed by: kib MFC after: 1 week --- sys/kern/uipc_shm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index cd1bf0b7142c..55362c5ad704 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -418,6 +418,7 @@ shm_dotruncate(struct shmfd *shmfd, off_t length) vm_ooffset_t delta; int base, rv; + KASSERT(length >= 0, ("shm_dotruncate: length < 0")); object = shmfd->shm_object; VM_OBJECT_WLOCK(object); if (length == shmfd->shm_size) { @@ -486,7 +487,7 @@ retry: vm_pager_page_unswapped(m); } } - delta = ptoa(object->size - nobjsize); + delta = IDX_TO_OFF(object->size - nobjsize); /* Toss in memory pages. */ if (nobjsize < object->size) @@ -501,8 +502,8 @@ retry: swap_release_by_cred(delta, object->cred); object->charge -= delta; } else { - /* Attempt to reserve the swap */ - delta = ptoa(nobjsize - object->size); + /* Try to reserve additional swap space. */ + delta = IDX_TO_OFF(nobjsize - object->size); if (!swap_reserve_by_cred(delta, object->cred)) { VM_OBJECT_WUNLOCK(object); return (ENOMEM);