Author: imp
Date: Thu Feb 2 23:04:06 2017
New Revision: 313113
URL: https://svnweb.freebsd.org/changeset/base/313113
Log:
Ensure that the passthrough request will fit in MAXPHYS bytes after it
has been rounded to full pages. This avoids a panic in
vm_fault_quick_hold_pages due to this off-by-one error passing one
page too many into vmapbuf.
Modified:
head/sys/dev/nvme/nvme_ctrlr.c
Modified: head/sys/dev/nvme/nvme_ctrlr.c
==============================================================================
--- head/sys/dev/nvme/nvme_ctrlr.c Thu Feb 2 23:04:01 2017
(r313112)
+++ head/sys/dev/nvme/nvme_ctrlr.c Thu Feb 2 23:04:06 2017
(r313113)
@@ -874,8 +874,20 @@ nvme_ctrlr_passthrough_cmd(struct nvme_c
struct mtx *mtx;
struct buf *buf = NULL;
int ret = 0;
+ vm_offset_t addr, end;
if (pt->len > 0) {
+ /*
+ * vmapbuf calls vm_fault_quick_hold_pages which only maps full
+ * pages. Ensure this request has fewer than MAXPHYS bytes when
+ * extended to full pages.
+ */
+ addr = (vm_offset_t)pt->buf;
+ end = round_page(addr + pt->len);
+ addr = trunc_page(addr);
+ if (end - addr > MAXPHYS)
+ return EIO;
+
if (pt->len > ctrlr->max_xfer_size) {
nvme_printf(ctrlr, "pt->len (%d) "
"exceeds max_xfer_size (%d)\n", pt->len,
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
