Page MenuHomeFreeBSD
Files F171081985

D59506.diff
No OneTemporary
Actions

D59506.diff
View Options

diff --git a/sys/amd64/amd64/pmap.c b/sys/amd64/amd64/pmap.c
--- a/sys/amd64/amd64/pmap.c
+++ b/sys/amd64/amd64/pmap.c
@@ -4993,6 +4993,7 @@
pde_store(pde, newpdir);
}
vm_page_array = (vm_page_t)start;
+ memset(vm_page_array, 0, pages * sizeof(struct vm_page));
#ifdef KMSAN
pmap_kmsan_page_array_startup(start, end);
diff --git a/sys/compat/linuxkpi/common/src/linux_page.c b/sys/compat/linuxkpi/common/src/linux_page.c
--- a/sys/compat/linuxkpi/common/src/linux_page.c
+++ b/sys/compat/linuxkpi/common/src/linux_page.c
@@ -528,9 +528,15 @@
retry:
page = vm_page_grab_iter(vm_obj, pindex, VM_ALLOC_NOCREAT, &pages);
if (page == NULL) {
+ /*
+ * Check for page->phys_addr against pfn is to avoid
+ * operating on unitialized vm_page_array elements,
+ * which is not uncommon driver bug.
+ */
page = PHYS_TO_VM_PAGE(IDX_TO_OFF(pfn));
- if (page == NULL)
+ if (page == NULL || VM_PAGE_TO_PHYS(page) != IDX_TO_OFF(pfn))
return (VM_FAULT_SIGBUS);
+
if (!vm_page_busy_acquire(page, VM_ALLOC_WAITFAIL)) {
pctrie_iter_reset(&pages);
goto retry;
diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c
--- a/sys/vm/vm_page.c
+++ b/sys/vm/vm_page.c
@@ -555,6 +555,7 @@
vm_page_array = (vm_page_t)pmap_map(vaddr, new_end, end,
VM_PROT_READ | VM_PROT_WRITE);
vm_page_array_size = page_range;
+ memset(vm_page_array, 0, vm_page_array_size * sizeof(struct vm_page));
return (new_end);
}
@@ -1313,7 +1314,7 @@
long pi;
pi = atop(pa);
- if (pi >= first_page && (pi - first_page) < vm_page_array_size) {
+ if (pi >= first_page && pi - first_page < vm_page_array_size) {
m = &vm_page_array[pi - first_page];
return (m);
}

File Metadata

Mime Type
text/plain
Expires
Wed, Sep 9, 2:30 PM (21 h, 53 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
38592592
Default Alt Text
D59506.diff (1 KB)

Event Timeline