upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-18 18:20:26 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix off-by-one in the vm_fault_populate() code.

Browse source 
When re-calculating the last inclusive page index after the pager
call, -1 was erronously ommitted.  If the pager extended the run
(unlikely), the result would be insertion of the valid page mapping
outside the current map entry range.

Found by:	alc
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
This commit is contained in:
Konstantin Belousov 2017-03-19 14:42:16 +00:00
parent 9c81a61ee1
commit bc27810671
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/vm/vm_fault.c
View file

@ -409,7 +409,7 @@ vm_fault_populate(struct faultstate *fs, vm_offset_t vaddr, vm_prot_t prot,
vm_fault_populate_cleanup(fs->first_object, pager_first,
map_first - 1);
map_last = MIN(OFF_TO_IDX(fs->entry->end - fs->entry->start +
fs->entry->offset), pager_last);
fs->entry->offset) - 1, pager_last);
if (map_last < pager_last)
vm_fault_populate_cleanup(fs->first_object, map_last + 1,
pager_last);