10.0 BETA 3 with redports kernel panic

[Konstantin Belousov]

On Mon, Dec 16, 2013 at 10:45:58AM -0800, Sean Bruno wrote:
> On Mon, 2013-12-16 at 10:04 -0800, Sean Bruno wrote:
> > > What is the source line for memrw+0x195 ?
> > 
> > My apologies for the delay on this.  Its been frustrating getting a
> > crashdump on these machines due to their very large tmpfs usage.
> > Currently, I am dumping a crash of 13+GB to a third HD that we had
> > installed for this purpose.
> > 
> > The machines are still running RC3 of 10.0r.
> > 
> > I will attempt to get the requested information shortly.
> > 
> > sean
> > 
> > 
> 
> I've updated http://people.freebsd.org/~sbruno/redbuild_panic.txt
> 
> It looks like its dying in uiomove() ?

I believe I already posted the following patch, with no feedback.

diff --git a/sys/amd64/amd64/mem.c b/sys/amd64/amd64/mem.c
index abbbb21..e371499 100644
--- a/sys/amd64/amd64/mem.c
+++ b/sys/amd64/amd64/mem.c
@@ -98,7 +98,11 @@ memrw(struct cdev *dev, struct uio *uio, int flags)
 kmemphys:
 			o = v & PAGE_MASK;
 			c = min(uio->uio_resid, (u_int)(PAGE_SIZE - o));
-			error = uiomove((void *)PHYS_TO_DMAP(v), (int)c, uio);
+			v = PHYS_TO_DMAP(v);
+			if (v < DMAP_MIN_ADDRESS || v >= DMAP_MAX_ADDRESS ||
+			    pmap_kextract(v) == 0)
+				return (EFAULT);
+			error = uiomove((void *)v, (int)c, uio);
 			continue;
 		}
 		else if (dev2unit(dev) == CDEV_MINOR_KMEM) {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 834 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20131217/bba6c7dc/attachment.sig>