From owner-p4-projects@FreeBSD.ORG  Fri Feb  1 18:16:12 2008
Return-Path: <owner-p4-projects@FreeBSD.ORG>
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 5A95816A41B; Fri,  1 Feb 2008 18:16:12 +0000 (UTC)
Delivered-To: perforce@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1948B16A419
	for <perforce@freebsd.org>; Fri,  1 Feb 2008 18:16:12 +0000 (UTC)
	(envelope-from kmacy@freebsd.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id 0BD3F13C442
	for <perforce@freebsd.org>; Fri,  1 Feb 2008 18:16:12 +0000 (UTC)
	(envelope-from kmacy@freebsd.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id m11IGBTP077797
	for <perforce@freebsd.org>; Fri, 1 Feb 2008 18:16:11 GMT
	(envelope-from kmacy@freebsd.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.14.1/8.14.1/Submit) id m11IGBPB077792
	for perforce@freebsd.org; Fri, 1 Feb 2008 18:16:11 GMT
	(envelope-from kmacy@freebsd.org)
Date: Fri, 1 Feb 2008 18:16:11 GMT
Message-Id: <200802011816.m11IGBPB077792@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to
	kmacy@freebsd.org using -f
From: Kip Macy <kmacy@FreeBSD.org>
To: Perforce Change Reviews <perforce@freebsd.org>
Cc: 
Subject: PERFORCE change 134595 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Feb 2008 18:16:12 -0000

http://perforce.freebsd.org/chv.cgi?CH=134595

Change 134595 by kmacy@kmacy:storage:toehead on 2008/02/01 18:15:23

	fix bounds checks in vm_fault_hold_pages

Affected files ...

.. //depot/projects/toehead/sys/dev/cxgb/ulp/tom/cxgb_vm.c#3 edit

Differences ...

==== //depot/projects/toehead/sys/dev/cxgb/ulp/tom/cxgb_vm.c#3 (text+ko) ====

@@ -37,9 +37,9 @@
 vm_fault_hold_user_pages(vm_offset_t addr, vm_page_t *mp, int count, int flags)
 {
 
-	vm_offset_t start, va;
+	vm_offset_t end, va;
 	vm_paddr_t pa;
-	int pageslen, faults, rv;
+	int faults, rv;
 
 	struct thread *td;
 	vm_map_t map;
@@ -53,8 +53,8 @@
 	 * and user do not share VA - however, it appears that all FreeBSD
 	 * architectures define it
 	 */
-	pageslen = count * PAGE_SIZE;
-	if (addr + pageslen > VM_MAXUSER_ADDRESS)
+	end = addr + (count * PAGE_SIZE);
+	if (end > VM_MAXUSER_ADDRESS)
 		return (EFAULT);
 
 	TRACE_ENTER;
@@ -72,7 +72,7 @@
 	 * if so just mark pages as held (and dirty if for write) and return
 	 */
 	vm_page_lock_queues();
-	for (start = addr, pages = mp, faults = 0, va = addr; va < start + pageslen; va += PAGE_SIZE, pages++) {
+	for (pages = mp, faults = 0, va = addr; va < end; va += PAGE_SIZE, pages++) {
 		/*
 		 * Assure that we only hold the page once
 		 */
@@ -106,7 +106,7 @@
 	 * trigger a fault where neccessary
 	 * 
 	 */
-	for (va = start; va < pageslen; va += PAGE_SIZE) {
+	for (va = addr; va < end; va += PAGE_SIZE) {
 		m = NULL;
 		pa = pmap_extract(pmap, va);
 		rv = 0;
@@ -124,10 +124,7 @@
 
 error:	
 	vm_page_lock_queues();
-	for (pages = mp,
-		 va = start; va < start + pageslen;
-	     va += PAGE_SIZE,
-		 pages++) 
+	for (pages = mp, va = addr; va < end; va += PAGE_SIZE, pages++)
 		if (*pages)
 			vm_page_unhold(*pages);
 	vm_page_unlock_queues();