HomeFreeBSD

In zone_alloc_bucket() max argument was calculated based on uz_count.

Description

In zone_alloc_bucket() max argument was calculated based on uz_count.
Then bucket_alloc() also selects bucket size based on uz_count. However,
since zone lock is dropped, uz_count may reduce. In this case max may
be greater than ub_entries and that would yield into writing beyond end
of the allocation.

Reported by: pho

Details

Committed
glebiusJan 31 2019, 5:52 PM
Parents
rS343615: MFC r343124:
Branches
Unknown
Tags
Unknown