From nobody Mon Sep 07 19:41:58 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hdyBZ58LDz6rwPp for ; Mon, 07 Sep 2026 19:41:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hdyBZ4Qhpz3GZv for ; Mon, 07 Sep 2026 19:41:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788810118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e2Wc7uhJ5dsmTtP6MZC6Sk878D1zbCUQRgrBGmBwHYo=; b=K86eZjW/BYDsQidW7tiVkF8LfGYZxuITAliUdO1emBKeXHnv1ymBU7po3bTz0P6KAY1/2v rgpzKwXyf5X/NcHu2dyynPW3Iy27Uj6AQISMNGQVm7bdRXTownEwzxrFHEx+XNNBq0lLDR t1PTMT30ANToFUIBanqDtPwkxEMswnoFCryERpE8njk5L3G0hvsKkkX+vKv/Wp/v7MfJoE /idKQQbdAMqcJ2XON7YHOEACLOCbkl69DRCTONMR696+U43NiMxUF7H1pu4C8LbjihgybG HdrWEqZQKK8r/2QyeFmnhtk8JTHv1OzxSRscbrylDZYBYlMbSeQDkn+upoXf7w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788810118; a=rsa-sha256; cv=none; b=pe3pMigGk8uZQ4xB64wd+amBIEvDxZUgN35SToQPs0p2HWGGdKiGiMO4rAWTmOUYIkVnXo o8M9kpUJtmEzrYYoGhcZC47AS6nG3Z5+rNXlJu2diDEgI9E1ksZ9w8dAD5UfKw/zbRfO0n 6ycDCZ0MeAz9h66FPiAr1Sd0Ne9xpUjYiVYvLFmH7h4wrWYarVzoYro/yHSj9hC/ajPMit v/5XZLSDF/SGh3FZ5NnXWD41HTtfxSMIIN4ybzCN3BofmM0UpqjbFwhdPIRX2KWWDRfS+X WlPG8KKU6w/mqxKLt9s4njGAdXARwpM0NRMY85GHFHJPLzAR5jVdi6mNkUlY4w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788810118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=e2Wc7uhJ5dsmTtP6MZC6Sk878D1zbCUQRgrBGmBwHYo=; b=iJJnzxDuGQJiu6Jc+Bcinh/b3fPG6FxfPkXvuu0qGgXqdiuoJYQoogFG2uKeAz7kWiTDyV Czpj/ADZLHmOz9294vR9r48ULBuhpsGoX1aCLrxWNOj9NnHdRUx+98aZRep/KHhUHjhlRU s1DobYfUWAy7JmfkTy16zlZGbWypMjpX9k5IkiIY87BN6UQ+f2PDj63LPih8TJ1zlyRSod ODa6eDobeqwZbb5qPGahvjbDLPhI9yOPQxuIZj43E26VUakKwVx2Cz0MEPM0xL8wM5P9rF vOZsFNmmBbG0MTIsIC+3iGGZWbJJaFwTg1RH6AztpgWREiqH2gOlKc0NiOfltQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hdyBZ38HnzWZy for ; Mon, 07 Sep 2026 19:41:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f9d9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 07 Sep 2026 19:41:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jean-=?utf-8?Q?S=C3=A9bast?==?utf-8?Q?ien P=C3=A9?=dron Subject: git: 8ffe2419e4e7 - main - linuxkpi: Fix assertion in `lkpi_vmf_insert_pfn_prot_locked()` List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dumbbell X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8ffe2419e4e74e05e8042ccc3c0445a13b41a02f Auto-Submitted: auto-generated Date: Mon, 07 Sep 2026 19:41:58 +0000 Message-Id: <6a9f1386.3f9d9.65e4900e@gitrepo.freebsd.org> The branch main has been updated by dumbbell: URL: https://cgit.FreeBSD.org/src/commit/?id=8ffe2419e4e74e05e8042ccc3c0445a13b41a02f commit 8ffe2419e4e74e05e8042ccc3c0445a13b41a02f Author: Jean-Sébastien Pédron AuthorDate: 2026-06-25 23:07:11 +0000 Commit: Jean-Sébastien Pédron CommitDate: 2026-09-07 19:40:44 +0000 linuxkpi: Fix assertion in `lkpi_vmf_insert_pfn_prot_locked()` Before this change, the assertion would not catch a page index matching the end address, even though the end address of a mapping is outside of that mapping. While here, add another assertion to catch page indexes outside of the expected range earlier. Also, pagefaulting an address outside of the mapping range should return `VM_FAULT_SIGBUS` instead of panicing. Reviewed by: bz Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58194 --- sys/compat/linuxkpi/common/src/linux_compat.c | 2 ++ sys/compat/linuxkpi/common/src/linux_page.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linux_compat.c b/sys/compat/linuxkpi/common/src/linux_compat.c index 32f9ce8c1f5c..12e5852c8dc9 100644 --- a/sys/compat/linuxkpi/common/src/linux_compat.c +++ b/sys/compat/linuxkpi/common/src/linux_compat.c @@ -560,6 +560,8 @@ linux_cdev_pager_populate(vm_object_t vm_obj, vm_pindex_t pidx, int fault_type, */ *first = vmap->vm_pfn_first; *last = *first + vmap->vm_pfn_count - 1; + MPASS(pidx >= *first); + MPASS(pidx <= *last); err = VM_PAGER_OK; break; default: diff --git a/sys/compat/linuxkpi/common/src/linux_page.c b/sys/compat/linuxkpi/common/src/linux_page.c index e0385bf2d40a..14abc3376a1c 100644 --- a/sys/compat/linuxkpi/common/src/linux_page.c +++ b/sys/compat/linuxkpi/common/src/linux_page.c @@ -515,12 +515,15 @@ lkpi_vmf_insert_pfn_prot_locked(struct vm_area_struct *vma, unsigned long addr, vm_page_t page; vm_pindex_t pindex; + if (addr < vma->vm_start || addr >= vma->vm_end) + return (VM_FAULT_SIGBUS); + VM_OBJECT_ASSERT_WLOCKED(vm_obj); vm_page_iter_init(&pages, vm_obj); pindex = OFF_TO_IDX(addr - vma->vm_start); if (vma->vm_pfn_count == 0) vma->vm_pfn_first = pindex; - MPASS(pindex <= OFF_TO_IDX(vma->vm_end)); + MPASS(pindex < OFF_TO_IDX(vma->vm_end)); retry: page = vm_page_grab_iter(vm_obj, pindex, VM_ALLOC_NOCREAT, &pages);