Adjust vnode_pager_input_smlfs() to not attempt to BMAP blocks beyond the

file EOF.  This works around a bug in the ISOFS (CDRom) BMAP code which
returns bogus values for requests beyond the file EOF rather then returning
an error, resulting in either corrupt data being mmap()'d beyond the file EOF
or resulting in a seg-fault on the last page of a mmap()'d file (mmap()s of
CDRom files).

Reported by: peter / Yahoo
MFC after:	3 days

1 files changed, 7 insertions, 2 deletions

diff --git a/sys/vm/vnode_pager.c b/sys/vm/vnode_pager.c
index 412bfab..9e6363b 100644
--- a/sys/vm/vnode_pager.c
+++ b/sys/vm/vnode_pager.c
@@ -422,12 +422,17 @@ vnode_pager_input_smlfs(object, m)
 	kva = vm_pager_map_page(m);
 
 	for (i = 0; i < PAGE_SIZE / bsize; i++) {
+		vm_ooffset_t address;
 
 		if (vm_page_bits(i * bsize, bsize) & m->valid)
 			continue;
 
-		fileaddr = vnode_pager_addr(vp,
-			IDX_TO_OFF(m->pindex) + i * bsize, (int *)0);
+		address = IDX_TO_OFF(m->pindex) + i * bsize;
+		if (address >= object->un_pager.vnp.vnp_size) {
+			fileaddr = -1;
+		} else {
+			fileaddr = vnode_pager_addr(vp, address, NULL);
+		}
 		if (fileaddr != -1) {
 			bp = getpbuf(&vnode_pbuf_freecnt);