From 63cdcaaead983ae836f4c6f6e14d2dedd77e668b Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Fri, 24 Feb 2017 08:09:16 +0000 Subject: [PATCH] Properly handle possible underflow in vm_fault_prefault(). In vm_fault_prefault(), if backward count causes underflow in calculation of starta = addra - backward * PAGE_SIZE; then starta must be clipped to entry->start, instead of zero. Clipping to zero allowed mapping outside of the map entries address ranges, in particular, map at zero. Submitted by: Yanko Yankulov Reviewed by: alc MFC after: 1 week --- sys/vm/vm_fault.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/sys/vm/vm_fault.c b/sys/vm/vm_fault.c index 149b7dc8905..52aeb90398f 100644 --- a/sys/vm/vm_fault.c +++ b/sys/vm/vm_fault.c @@ -1368,11 +1368,12 @@ vm_fault_prefault(const struct faultstate *fs, vm_offset_t addra, entry = fs->entry; - starta = addra - backward * PAGE_SIZE; - if (starta < entry->start) { + if (addra < backward * PAGE_SIZE) { starta = entry->start; - } else if (starta > addra) { - starta = 0; + } else { + starta = addra - backward * PAGE_SIZE; + if (starta < entry->start) + starta = entry->start; } /*