From nobody Mon Sep 07 19:41:58 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hdyBh3HPyz6rwXQ for ; Mon, 07 Sep 2026 19:42:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hdyBh04Lfz3GkY for ; Mon, 07 Sep 2026 19:42:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788810124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e2Wc7uhJ5dsmTtP6MZC6Sk878D1zbCUQRgrBGmBwHYo=; b=vm5XGwrq0IJdObGIlC234sw269V2cVE7H6eCaaHnx0ax+hJJqpyHlMOSSFy94tS+EDEyfY imOCnZOqL/e3GGRhY0D9JuR/PzkSPXBx8LjAOMeuIstguhbgS/JoIQU0iW5Q9PICNbsxRn cq5Z/BA2MSlUr5hDeMSC0JT0r8tXqJGnZt0+1O9FELZOR7kvIjVseb89M74oiS3nBlLJqg CsZUm7K37gkS5uMevhZZ2nZcPze/QkHdyNwm/p10u4B4nOnmvbxdEuTya+UXHKfbV6W70m nxREmHb2i7nLqVFttdd07iujpODD9rV2ZdhmRYkhoejSn+F808XTilHmFCMTKQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788810124; a=rsa-sha256; cv=none; b=k3FnOBq+Al6Eo4WGWRnA2A+9aN4E6dJSaSVq48m94DXw9UVsvaiy/M04b27BJhM/GSrxTb E/nxVbpYmCwpXWGmG3ThIy3FrYiF1r/yJ+/aI4Nn2QdYJ4KZJx4KTQKSoOuQKcq/sJxO2v TkSD9MhWd5raWl/pwe6JsS5xXaQY3VlDfYV3xUdlJ8CkMz2fF+ch2tJuU8U0WNRldUN+fX ctkQUkxUqBWcs5xZeu430FPx6K0RIm/argg4hmbk50cabK5unV1s33sJoVHuj8055jw0d+ ms5YtWiGLTuZ9IItk8ZrjRM+SxXZRyY0eET/xcSwc2BNCRrkZ1jIpO2UkIco/Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788810124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e2Wc7uhJ5dsmTtP6MZC6Sk878D1zbCUQRgrBGmBwHYo=; b=sRxlwu5k1mWWoYfPV3qaLloOSgrF71UThpEQgyg1oxVIWQqSW5+cDAWBF++nLkTV3SfgwY s5MW+mHfT1QspkmMzq3ffS7YLgIowb+I1P5GIgWeRiNmugI5lPT71Jbz+gt0fTrD44b6D+ /+dpvv7QHcgbIzB4AeE4eaXUxYoPpksDgGRlUx34kp3wbznWXeOw2cnyQOeEIkRHf9mHp3 P9P7Q1N0pqDf5moUKjmIwb/3Cfv62GuemDhwuwiLVJrxAopOl5+lKpaRmkQpVDEPb7/yTC atCrgigu+3gSjl1UerraeyaW/FbI/G+KNdpXSfF3K8Khc2YYcn11SjB3F//Z+Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hdyBg61K6zXmk for ; Mon, 07 Sep 2026 19:42:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f9d9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 07 Sep 2026 19:41:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jean-=?utf-8?Q?S=C3=A9bast?==?utf-8?Q?ien P=C3=A9?=dron Subject: git: 8ffe2419e4e7 - main - linuxkpi: Fix assertion in `lkpi_vmf_insert_pfn_prot_locked()` List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dumbbell X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8ffe2419e4e74e05e8042ccc3c0445a13b41a02f Auto-Submitted: auto-generated Date: Mon, 07 Sep 2026 19:41:58 +0000 Message-Id: <6a9f1386.3f9d9.65e4900e@gitrepo.freebsd.org> The branch main has been updated by dumbbell: URL: https://cgit.FreeBSD.org/src/commit/?id=8ffe2419e4e74e05e8042ccc3c0445a13b41a02f commit 8ffe2419e4e74e05e8042ccc3c0445a13b41a02f Author: Jean-Sébastien Pédron AuthorDate: 2026-06-25 23:07:11 +0000 Commit: Jean-Sébastien Pédron CommitDate: 2026-09-07 19:40:44 +0000 linuxkpi: Fix assertion in `lkpi_vmf_insert_pfn_prot_locked()` Before this change, the assertion would not catch a page index matching the end address, even though the end address of a mapping is outside of that mapping. While here, add another assertion to catch page indexes outside of the expected range earlier. Also, pagefaulting an address outside of the mapping range should return `VM_FAULT_SIGBUS` instead of panicing. Reviewed by: bz Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58194 --- sys/compat/linuxkpi/common/src/linux_compat.c | 2 ++ sys/compat/linuxkpi/common/src/linux_page.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linux_compat.c b/sys/compat/linuxkpi/common/src/linux_compat.c index 32f9ce8c1f5c..12e5852c8dc9 100644 --- a/sys/compat/linuxkpi/common/src/linux_compat.c +++ b/sys/compat/linuxkpi/common/src/linux_compat.c @@ -560,6 +560,8 @@ linux_cdev_pager_populate(vm_object_t vm_obj, vm_pindex_t pidx, int fault_type, */ *first = vmap->vm_pfn_first; *last = *first + vmap->vm_pfn_count - 1; + MPASS(pidx >= *first); + MPASS(pidx <= *last); err = VM_PAGER_OK; break; default: diff --git a/sys/compat/linuxkpi/common/src/linux_page.c b/sys/compat/linuxkpi/common/src/linux_page.c index e0385bf2d40a..14abc3376a1c 100644 --- a/sys/compat/linuxkpi/common/src/linux_page.c +++ b/sys/compat/linuxkpi/common/src/linux_page.c @@ -515,12 +515,15 @@ lkpi_vmf_insert_pfn_prot_locked(struct vm_area_struct *vma, unsigned long addr, vm_page_t page; vm_pindex_t pindex; + if (addr < vma->vm_start || addr >= vma->vm_end) + return (VM_FAULT_SIGBUS); + VM_OBJECT_ASSERT_WLOCKED(vm_obj); vm_page_iter_init(&pages, vm_obj); pindex = OFF_TO_IDX(addr - vma->vm_start); if (vma->vm_pfn_count == 0) vma->vm_pfn_first = pindex; - MPASS(pindex <= OFF_TO_IDX(vma->vm_end)); + MPASS(pindex < OFF_TO_IDX(vma->vm_end)); retry: page = vm_page_grab_iter(vm_obj, pindex, VM_ALLOC_NOCREAT, &pages);