D59506.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D59506.diff
View Options

	diff --git a/sys/compat/linuxkpi/common/src/linux_page.c b/sys/compat/linuxkpi/common/src/linux_page.c
	--- a/sys/compat/linuxkpi/common/src/linux_page.c
	+++ b/sys/compat/linuxkpi/common/src/linux_page.c
	@@ -528,9 +528,15 @@
	retry:
	page = vm_page_grab_iter(vm_obj, pindex, VM_ALLOC_NOCREAT, &pages);
	if (page == NULL) {
	+ /*
	+ * Check for page->phys_addr against pfn is to avoid
	+ * operating on unitialized vm_page_array elements,
	+ * which is not uncommon driver bug.
	+ */
	page = PHYS_TO_VM_PAGE(IDX_TO_OFF(pfn));
	- if (page == NULL)
	+ if (page == NULL \|\| VM_PAGE_TO_PHYS(page) != IDX_TO_OFF(pfn))
	return (VM_FAULT_SIGBUS);
	+
	if (!vm_page_busy_acquire(page, VM_ALLOC_WAITFAIL)) {
	pctrie_iter_reset(&pages);
	goto retry;
	diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c
	--- a/sys/vm/vm_page.c
	+++ b/sys/vm/vm_page.c
	@@ -555,6 +555,7 @@
	vm_page_array = (vm_page_t)pmap_map(vaddr, new_end, end,
	VM_PROT_READ \| VM_PROT_WRITE);
	vm_page_array_size = page_range;
	+ memset(vm_page_array, 0, vm_page_array_size * sizeof(struct vm_page));

	return (new_end);
	}
	@@ -715,6 +716,7 @@

	#ifdef PMAP_HAS_PAGE_ARRAY
	pmap_page_array_startup(size / PAGE_SIZE);
	+ memset(vm_page_array, 0, vm_page_array_size * sizeof(struct vm_page));
	biggestone = vm_phys_avail_largest();
	end = new_end = phys_avail[biggestone + 1];
	#else
	@@ -1313,7 +1315,7 @@
	long pi;

	pi = atop(pa);
	- if (pi >= first_page && (pi - first_page) < vm_page_array_size) {
	+ if (pi >= first_page && pi - first_page < vm_page_array_size) {
	m = &vm_page_array[pi - first_page];
	return (m);
	}