Module Name: src
Committed By: maxv
Date: Mon Mar 11 20:38:28 UTC 2019
Modified Files:
src/sys/kern: subr_pool.c
Log Message:
Add sanity check: make sure we retrieve a valid item header, by checking
its page address against the one we computed. If there's a mismatch it
means the buffer does not belong to the pool, and we panic.
To generate a diff of this commit:
cvs rdiff -u -r1.234 -r1.235 src/sys/kern/subr_pool.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/subr_pool.c
diff -u src/sys/kern/subr_pool.c:1.234 src/sys/kern/subr_pool.c:1.235
--- src/sys/kern/subr_pool.c:1.234 Mon Mar 11 20:21:32 2019
+++ src/sys/kern/subr_pool.c Mon Mar 11 20:38:27 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: subr_pool.c,v 1.234 2019/03/11 20:21:32 maxv Exp $ */
+/* $NetBSD: subr_pool.c,v 1.235 2019/03/11 20:38:27 maxv Exp $ */
/*
* Copyright (c) 1997, 1999, 2000, 2002, 2007, 2008, 2010, 2014, 2015, 2018
@@ -33,7 +33,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: subr_pool.c,v 1.234 2019/03/11 20:21:32 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: subr_pool.c,v 1.235 2019/03/11 20:38:27 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_ddb.h"
@@ -431,7 +431,12 @@ pr_find_pagehead(struct pool *pp, void *
(void *)((uintptr_t)v & pp->pr_alloc->pa_pagemask);
if ((pp->pr_roflags & PR_PHINPAGE) != 0) {
- ph = (struct pool_item_header *)((char *)page + pp->pr_phoffset);
+ ph = (struct pool_item_header *)
+ ((char *)page + pp->pr_phoffset);
+ if (__predict_false((void *)ph->ph_page != page)) {
+ panic("%s: [%s] item not part of pool",
+ __func__, pp->pr_wchan);
+ }
} else {
tmp.ph_page = page;
ph = SPLAY_FIND(phtree, &pp->pr_phtree, &tmp);
