Module Name: src
Committed By: pgoyette
Date: Sun Oct 1 01:45:02 UTC 2017
Modified Files:
src/sys/uvm: uvm_map.c
Log Message:
Fix user-triggerable kernel crash as reported in PR kern/52573 (from
Bruno Haible).
XXX Pull-up to netbsd-8
To generate a diff of this commit:
cvs rdiff -u -r1.351 -r1.352 src/sys/uvm/uvm_map.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/uvm/uvm_map.c
diff -u src/sys/uvm/uvm_map.c:1.351 src/sys/uvm/uvm_map.c:1.352
--- src/sys/uvm/uvm_map.c:1.351 Tue May 30 17:09:17 2017
+++ src/sys/uvm/uvm_map.c Sun Oct 1 01:45:02 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: uvm_map.c,v 1.351 2017/05/30 17:09:17 chs Exp $ */
+/* $NetBSD: uvm_map.c,v 1.352 2017/10/01 01:45:02 pgoyette Exp $ */
/*
* Copyright (c) 1997 Charles D. Cranor and Washington University.
@@ -66,7 +66,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.351 2017/05/30 17:09:17 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.352 2017/10/01 01:45:02 pgoyette Exp $");
#include "opt_ddb.h"
#include "opt_pax.h"
@@ -4991,7 +4991,7 @@ fill_vmentries(struct lwp *l, pid_t pid,
vme = kmem_alloc(vmesize, KM_SLEEP);
for (entry = map->header.next; entry != &map->header;
entry = entry->next) {
- if (oldp && (dp - (char *)oldp) < *oldlenp) {
+ if (oldp && (dp - (char *)oldp) < vmesize) {
error = fill_vmentry(l, p, &vme[count], map, entry);
if (error)
goto out;
@@ -5009,7 +5009,7 @@ out:
const u_int esize = min(sizeof(*vme), elem_size);
dp = oldp;
for (size_t i = 0; i < count; i++) {
- if (oldp && (dp - (char *)oldp) < *oldlenp) {
+ if (oldp && (dp - (char *)oldp) < vmesize) {
error = sysctl_copyout(l, &vme[i], dp, esize);
if (error)
break;
