Author: kib
Date: Sun Mar 19 14:42:16 2017
New Revision: 315552
URL: https://svnweb.freebsd.org/changeset/base/315552
Log:
Fix off-by-one in the vm_fault_populate() code.
When re-calculating the last inclusive page index after the pager
call, -1 was erronously ommitted. If the pager extended the run
(unlikely), the result would be insertion of the valid page mapping
outside the current map entry range.
Found by: alc
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Modified:
head/sys/vm/vm_fault.c
Modified: head/sys/vm/vm_fault.c
==============================================================================
--- head/sys/vm/vm_fault.c Sun Mar 19 14:40:01 2017 (r315551)
+++ head/sys/vm/vm_fault.c Sun Mar 19 14:42:16 2017 (r315552)
@@ -409,7 +409,7 @@ vm_fault_populate(struct faultstate *fs,
vm_fault_populate_cleanup(fs->first_object, pager_first,
map_first - 1);
map_last = MIN(OFF_TO_IDX(fs->entry->end - fs->entry->start +
- fs->entry->offset), pager_last);
+ fs->entry->offset) - 1, pager_last);
if (map_last < pager_last)
vm_fault_populate_cleanup(fs->first_object, map_last + 1,
pager_last);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
