Fri Aug 4 13:15:25 2023 UTC ()

Pull up following revision(s) (requested by riastradh in ticket #1880):

	sys/uvm/uvm_map.c: revision 1.403 (patch)

mmap(2): Avoid arithmetic overflow in search for free space.

PR kern/56900


(martin)

diff -r1.351.2.5 -r1.351.2.6 src/sys/uvm/uvm_map.c

--- src/sys/uvm/uvm_map.c 2023/04/01 16:05:00	1.351.2.5
+++ src/sys/uvm/uvm_map.c 2023/08/04 13:15:25	1.351.2.6

 @@ -1,14 +1,14 @@
-/*	$NetBSD: uvm_map.c,v 1.351.2.5 2023/04/01 16:05:00 martin Exp $	*/
+/*	$NetBSD: uvm_map.c,v 1.351.2.6 2023/08/04 13:15:25 martin Exp $	*/
 /*
  * Copyright (c) 1997 Charles D. Cranor and Washington University.
  * Copyright (c) 1991, 1993, The Regents of the University of California.
+ *
  * All rights reserved.
+ *
  * This code is derived from software contributed to Berkeley by
  * The Mach Operating System project at Carnegie-Mellon University.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -56,27 +56,27 @@
  *  School of Computer Science
  *  Carnegie Mellon University
  *  Pittsburgh PA 15213-3890
+ *
  * any improvements or extensions that they make and grant Carnegie the
  * rights to redistribute these changes.
  */
 /*
  * uvm_map.c: uvm map operations
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.351.2.5 2023/04/01 16:05:00 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.351.2.6 2023/08/04 13:15:25 martin Exp $");
 #include "opt_ddb.h"
 #include "opt_pax.h"
 #include "opt_uvmhist.h"
 #include "opt_uvm.h"
 #include "opt_sysv.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mman.h>
 #include <sys/proc.h>
 #include <sys/pool.h>
 #include <sys/kernel.h>
 @@ -2004,27 +2004,41 @@ uvm_map_findspace(struct vm_map *map, va
 				goto nextgap;
+			}
+		}
+	}
 	/*
 	 * Note that all UVM_FLAGS_FIXED case is already handled.
 	 */
 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
 	/* Try to find the space in the red-black tree */
 	/* Check slot before any entry */
-	hint = topdown ? entry->next->start - length : entry->end;
+	if (topdown) {
 		KASSERTMSG(entry->next->start >= vm_map_min(map),
 		    "map=%p entry=%p entry->next=%p"
 		    " entry->next->start=0x%"PRIxVADDR" min=0x%"PRIxVADDR,
 		    map, entry, entry->next,
 		    entry->next->start, vm_map_min(map));
 		if (length > entry->next->start - vm_map_min(map))
 			hint = vm_map_min(map); /* XXX goto wraparound? */
 		else
 			hint = entry->next->start - length;
 		KASSERT(hint >= vm_map_min(map));
 	} else {
 		hint = entry->end;
+	}
 	switch (uvm_map_space_avail(&hint, length, uoffset, align, flags,
 	    topdown, entry)) {
 	case 1:
 		goto found;
 	case -1:
 		goto wraparound;
+	}
 nextgap:
 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
 	/* If there is not enough space in the whole tree, we fail */
 	tmp = ROOT_ENTRY(map);
 	if (tmp == NULL || tmp->maxgap < length)