svn commit: r315552 - head/sys/vm

[Konstantin Belousov]

Author: kib
Date: Sun Mar 19 14:42:16 2017
New Revision: 315552
URL: https://svnweb.freebsd.org/changeset/base/315552

Log:
  Fix off-by-one in the vm_fault_populate() code.
  
  When re-calculating the last inclusive page index after the pager
  call, -1 was erronously ommitted.  If the pager extended the run
  (unlikely), the result would be insertion of the valid page mapping
  outside the current map entry range.
  
  Found by:	alc
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week

Modified:
  head/sys/vm/vm_fault.c

Modified: head/sys/vm/vm_fault.c
==============================================================================
--- head/sys/vm/vm_fault.c	Sun Mar 19 14:40:01 2017	(r315551)
+++ head/sys/vm/vm_fault.c	Sun Mar 19 14:42:16 2017	(r315552)
@@ -409,7 +409,7 @@ vm_fault_populate(struct faultstate *fs,
 		vm_fault_populate_cleanup(fs->first_object, pager_first,
 		    map_first - 1);
 	map_last = MIN(OFF_TO_IDX(fs->entry->end - fs->entry->start +
-	    fs->entry->offset), pager_last);
+	    fs->entry->offset) - 1, pager_last);
 	if (map_last < pager_last)
 		vm_fault_populate_cleanup(fs->first_object, map_last + 1,
 		    pager_last);