d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Properly handle possible underflow in vm_fault_prefault().

Browse Source 
In vm_fault_prefault(), if backward count causes underflow in
calculation of
	starta = addra - backward * PAGE_SIZE;
then starta must be clipped to entry->start, instead of zero.
Clipping to zero allowed mapping outside of the map entries address
ranges, in particular, map at zero.

Submitted by:	Yanko Yankulov <yanko.yankulov@gmail.com>
Reviewed by:	alc
MFC after:	1 week
This commit is contained in:
kib 2017-02-24 08:09:16 +00:00
parent b50f2868e5
commit 568d99bbad
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/vm/vm_fault.c
View File

@ -1368,11 +1368,12 @@ vm_fault_prefault(const struct faultstate *fs, vm_offset_t addra,
entry = fs->entry;
starta = addra - backward * PAGE_SIZE;
if (starta < entry->start) {
if (addra < backward * PAGE_SIZE) {
starta = entry->start;
} else if (starta > addra) {
starta = 0;
} else {
starta = addra - backward * PAGE_SIZE;
if (starta < entry->start)
starta = entry->start;
}
/*