Author: mav
Date: Thu Feb 1 16:24:03 2018
New Revision: 328675
URL: https://svnweb.freebsd.org/changeset/base/328675
Log:
MFC r313113 (by imp):
Ensure that the passthrough request will fit in MAXPHYS bytes after it
has been rounded to full pages. This avoids a panic in
vm_fault_quick_hold_pages due to this off-by-one error passing one
page too many into vmapbuf.
Modified:
stable/11/sys/dev/nvme/nvme_ctrlr.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/dev/nvme/nvme_ctrlr.c
==============================================================================
--- stable/11/sys/dev/nvme/nvme_ctrlr.c Thu Feb 1 16:22:28 2018
(r328674)
+++ stable/11/sys/dev/nvme/nvme_ctrlr.c Thu Feb 1 16:24:03 2018
(r328675)
@@ -874,8 +874,20 @@ nvme_ctrlr_passthrough_cmd(struct nvme_controller *ctr
struct mtx *mtx;
struct buf *buf = NULL;
int ret = 0;
+ vm_offset_t addr, end;
if (pt->len > 0) {
+ /*
+ * vmapbuf calls vm_fault_quick_hold_pages which only maps full
+ * pages. Ensure this request has fewer than MAXPHYS bytes when
+ * extended to full pages.
+ */
+ addr = (vm_offset_t)pt->buf;
+ end = round_page(addr + pt->len);
+ addr = trunc_page(addr);
+ if (end - addr > MAXPHYS)
+ return EIO;
+
if (pt->len > ctrlr->max_xfer_size) {
nvme_printf(ctrlr, "pt->len (%d) "
"exceeds max_xfer_size (%d)\n", pt->len,
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
