Module Name: src
Committed By: msaitoh
Date: Sun Jul 28 05:28:53 UTC 2019
Modified Files:
src/sys/uvm: uvm_aobj.c
Log Message:
Avoid undefined behavior in uao_pagein_page(). Found by kUBSan. OK'd by
riastradh. I think this is a real bug on amd64 at least.
To generate a diff of this commit:
cvs rdiff -u -r1.127 -r1.128 src/sys/uvm/uvm_aobj.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/uvm/uvm_aobj.c
diff -u src/sys/uvm/uvm_aobj.c:1.127 src/sys/uvm/uvm_aobj.c:1.128
--- src/sys/uvm/uvm_aobj.c:1.127 Mon May 28 21:04:35 2018
+++ src/sys/uvm/uvm_aobj.c Sun Jul 28 05:28:53 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: uvm_aobj.c,v 1.127 2018/05/28 21:04:35 chs Exp $ */
+/* $NetBSD: uvm_aobj.c,v 1.128 2019/07/28 05:28:53 msaitoh Exp $ */
/*
* Copyright (c) 1998 Chuck Silvers, Charles D. Cranor and
@@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uvm_aobj.c,v 1.127 2018/05/28 21:04:35 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uvm_aobj.c,v 1.128 2019/07/28 05:28:53 msaitoh Exp $");
#ifdef _KERNEL_OPT
#include "opt_uvmhist.h"
@@ -1342,7 +1342,7 @@ uao_pagein_page(struct uvm_aobj *aobj, i
npages = 1;
KASSERT(mutex_owned(uobj->vmobjlock));
- rv = uao_get(uobj, pageidx << PAGE_SHIFT, &pg, &npages,
+ rv = uao_get(uobj, (voff_t)pageidx << PAGE_SHIFT, &pg, &npages,
0, VM_PROT_READ | VM_PROT_WRITE, 0, PGO_SYNCIO);
/*
