From nobody Thu Apr 24 15:49:40 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zk0lm6PWCz5tTND; Thu, 24 Apr 2025 15:49:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zk0lm4LBsz45Md; Thu, 24 Apr 2025 15:49:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745509780; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gicd6LBNtPnaYI0tiwD8cuGz20vwpfpxl4KlZU76mhs=; b=NY2eAxKuXp0BEeqRg31bKC445mnLpny0ZTWdogFs9jeo4aeaM3n4MZqqoI60jvgLBIebuE 4aitC0JW3zs+5I02YRgYRZjzE3S7FJxaReW9VC1dcv8jchJNOSpOpGa+E+GOsrhnTcOEkB m2sHxroTuGKtjS169OBRsh+sDapJEIKCcqfAWPvPgeLUPI2DbDnfiQMTiHc3toLzDj4I+U QJ1axU7sV5IAB+Cbjf8UVTN0isiDCaIPc8GJySx0HpOdT6sX2+3j+dQVbwfifW3OawGFBz 9VqLydwRglyEWp+3YNH8bDs5pypma2HHyvTcGhd2teXsrP+zp9WNj5Oe6HFaHA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1745509780; a=rsa-sha256; cv=none; b=jTU5QU8NPOTl2k5NUyz5ljWEylUVJrgMSUlu3J7OYULeVuNV8mgEr6uUjsT3TNsZLh/X8J wOWOvW1uUYZHRnfgSZm/kRV0v66f0xuAh0ApVkKX//rgov+7NXFJa46me8Yc/53kbWtM98 Gty5QtWs7HivxoOSX4JdjTwqb4SaWf5VshAUomA+Uysm9NNavA4PfaJwdh4V0uY1t7Y81Y ZXQuDh2cmC++kYQ2c+V3zYycWU0q1H/PgnClTE9SAgwGlGGEdtczIRnl3HQ6QZJuxC6GX5 0cakeFpo3UViGW0MQzZCAdg1JCzrT5bsneIZ7xYwaoz5TPgT7qeErlXD1LVKQA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745509780; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gicd6LBNtPnaYI0tiwD8cuGz20vwpfpxl4KlZU76mhs=; b=nWxmgCR6YULbfYFtzXu7r52JtIVQf+xiBtvp1BMUZY6KdMAPq6nkGQ5EtfcEQ9GN/vUS6e do7HS57Lu6iywZqTl12mvukIuBiQ8ExKNKuUw+O1xTGqyqhMrsJjui1BIKA8o6GTZHTLFX pnoLl87mwoMyQ4qm3mKgzLBRhLVEjiwKHT+dv+JnbyK0oVdHEgOD3jQ6CW5IakKVEtVaA0 jAXIHugz/JPRW3OT0F+5WsvbaurH+ZsQ2t3ya+Zvcvxy2/uByNlixK41hL4dNQlhim67RR aOjQ9T0FSB9RmAZCTWQyTdVp/HDpjhcKH7wsGrKYX9kTmxpZJ8wce92L0mRGrQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zk0lm3hTZzwSm; Thu, 24 Apr 2025 15:49:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53OFneU8008873; Thu, 24 Apr 2025 15:49:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53OFneU1008870; Thu, 24 Apr 2025 15:49:40 GMT (envelope-from git) Date: Thu, 24 Apr 2025 15:49:40 GMT Message-Id: <202504241549.53OFneU1008870@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Doug Moore Subject: git: 1cce7d86c86a - main - vm_map: fix iterator jump size List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dougm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1cce7d86c86ae690d6f1d8120811792bb65e95cc Auto-Submitted: auto-generated The branch main has been updated by dougm: URL: https://cgit.FreeBSD.org/src/commit/?id=1cce7d86c86ae690d6f1d8120811792bb65e95cc commit 1cce7d86c86ae690d6f1d8120811792bb65e95cc Author: Doug Moore AuthorDate: 2025-04-24 15:47:41 +0000 Commit: Doug Moore CommitDate: 2025-04-24 15:47:41 +0000 vm_map: fix iterator jump size The index value in the loop in vm_map_pmap_enter jumps by 1, or some superpage size, in each iteration. Jump by the superpage size only when the entire superpage is being mapped. Reported by: pho Reported-by: syzbot+1cc9ede76727d2ea2e8d@syzkaller.appspotmail.com Reviewed by: alc, kib, markj Tested by: pho Fixes: Fixes: b3d89a0cde94 ("vm_map: use page iterators in pmap_enter") Differential Revision: https://reviews.freebsd.org/D49987 --- sys/vm/vm_map.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c index 0371680f6df5..c6182f9ce30f 100644 --- a/sys/vm/vm_map.c +++ b/sys/vm/vm_map.c @@ -2678,7 +2678,7 @@ vm_map_pmap_enter(vm_map_t map, vm_offset_t addr, vm_prot_t prot, struct pctrie_iter pages; vm_offset_t start; vm_page_t p, p_start; - vm_pindex_t mask, psize, threshold, tmpidx; + vm_pindex_t jump, mask, psize, threshold, tmpidx; int psind; if ((prot & (VM_PROT_READ | VM_PROT_EXECUTE)) == 0 || object == NULL) @@ -2710,7 +2710,7 @@ vm_map_pmap_enter(vm_map_t map, vm_offset_t addr, vm_prot_t prot, vm_page_iter_limit_init(&pages, object, pindex + psize); for (p = vm_radix_iter_lookup_ge(&pages, pindex); p != NULL; - p = vm_radix_iter_jump(&pages, mask + 1)) { + p = vm_radix_iter_jump(&pages, jump)) { /* * don't allow an madvise to blow away our really * free pages allocating pv entries. @@ -2723,7 +2723,7 @@ vm_map_pmap_enter(vm_map_t map, vm_offset_t addr, vm_prot_t prot, psize = tmpidx; break; } - mask = 0; + jump = 1; if (vm_page_all_valid(p)) { if (p_start == NULL) { start = addr + ptoa(tmpidx); @@ -2737,6 +2737,7 @@ vm_map_pmap_enter(vm_map_t map, vm_offset_t addr, vm_prot_t prot, if (tmpidx + mask < psize && vm_page_ps_test(p, psind, PS_ALL_VALID, NULL)) { + jump += mask; threshold += mask; break; }