diff options
| author |   miod <miod@openbsd.org> | 2014-04-05 17:18:00 +0000 |
|---|---|---|
| committer | miod <miod@openbsd.org> | 2014-04-05 17:18:00 +0000 |
| commit | baa047401e6f693deb148df3ae5225ab4af7eed6 (patch) | |
| tree | de9636e5f94983340a67ae6049b04d34edaf3292 /sys/uvm/uvm_pmemrange.c | |
| parent | enable hds, and give up on isp (diff) | |
| download | wireguard-openbsd-baa047401e6f693deb148df3ae5225ab4af7eed6.tar.xz wireguard-openbsd-baa047401e6f693deb148df3ae5225ab4af7eed6.zip | |
Fix logic error and prevent theoretical infinite loop in the worst case scenario
in uvm_pmr_rootupdate(). Issue spotted and fix provided by Kieran Devlin.
Diffstat (limited to 'sys/uvm/uvm_pmemrange.c')
| -rw-r--r-- | sys/uvm/uvm_pmemrange.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/uvm/uvm_pmemrange.c b/sys/uvm/uvm_pmemrange.c index 94dc842baa5..3eb24f4b5f8 100644 --- a/sys/uvm/uvm_pmemrange.c +++ b/sys/uvm/uvm_pmemrange.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_pmemrange.c,v 1.38 2014/03/21 21:39:36 miod Exp $ */ +/* $OpenBSD: uvm_pmemrange.c,v 1.39 2014/04/05 17:18:00 miod Exp $ */ /* * Copyright (c) 2009, 2010 Ariane van der Steldt <ariane@stack.nl> @@ -1645,7 +1645,7 @@ uvm_pmr_rootupdate(struct uvm_pmemrange *pmr, struct vm_page *init_root, * Cache the lower page, so we can page-walk later. */ low = root; - low_next = RB_RIGHT(low, objt); + low_next = RB_LEFT(low, objt); while (low_next != NULL && PMR_INTERSECTS_WITH( atop(VM_PAGE_TO_PHYS(low_next)), atop(VM_PAGE_TO_PHYS(low_next)) + low_next->fpgsz, @@ -1653,9 +1653,12 @@ uvm_pmr_rootupdate(struct uvm_pmemrange *pmr, struct vm_page *init_root, low = low_next; if (uvm_pmr_pg_to_memtype(low) == memtype) return low; - low_next = RB_RIGHT(low, objt); + low_next = RB_LEFT(low, objt); } + if (low == high) + return NULL; + /* * Ack, no hits. Walk the address tree until to find something usable. */ |