diff options
| author | dg <dg@FreeBSD.org> | 1995-05-18 02:59:26 +0000 |
|---|---|---|
| committer | dg <dg@FreeBSD.org> | 1995-05-18 02:59:26 +0000 |
| commit | 56d21b42187f0f163a5c67c2126117d7ff8bc6fc (patch) | |
| tree | 7392d140844fbfda67ab8ff22f1dafd98f01ae78 /sys/vm/vm_fault.c | |
| parent | 2831e6ec6177d558463cf22f90a0a04d21b4934b (diff) | |
| download | FreeBSD-src-56d21b42187f0f163a5c67c2126117d7ff8bc6fc.zip FreeBSD-src-56d21b42187f0f163a5c67c2126117d7ff8bc6fc.tar.gz | |
Accessing pages beyond the end of a mapped file results in internal
inconsistencies in the VM system that eventually lead to a panic. These
changes fix the behavior to conform to the behavior in SunOS, which is
to deny faults to pages beyond the EOF (returning SIGBUS). Internally,
this is implemented by requiring faults to be within the object size
boundaries. These changes exposed another bug, namely that passing in
an offset to mmap when trying to map an unnamed anonymous region also
results in internal inconsistencies. In this case, the offset is forced
to zero.
Reviewed by: John Dyson and others
Diffstat (limited to 'sys/vm/vm_fault.c')
| -rw-r--r-- | sys/vm/vm_fault.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/vm/vm_fault.c b/sys/vm/vm_fault.c index fd5ab56..aba9ecf 100644 --- a/sys/vm/vm_fault.c +++ b/sys/vm/vm_fault.c @@ -66,7 +66,7 @@ * any improvements or extensions that they make and grant Carnegie the * rights to redistribute these changes. * - * $Id: vm_fault.c,v 1.22 1995/04/09 06:03:48 davidg Exp $ + * $Id: vm_fault.c,v 1.23 1995/04/16 14:12:12 davidg Exp $ */ /* @@ -300,6 +300,10 @@ RetryFault:; if (((object->pager != NULL) && (!change_wiring || wired)) || (object == first_object)) { + if (offset >= object->size) { + UNLOCK_AND_DEALLOCATE; + return (KERN_PROTECTION_FAILURE); + } if (swap_pager_full && !object->shadow && (!object->pager || (object->pager && object->pager->pg_type == PG_SWAP && !vm_pager_has_page(object->pager, offset + object->paging_offset)))) { |
