From owner-svn-src-head@freebsd.org Mon Jan 18 00:07:05 2016 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6793A86DBD; Mon, 18 Jan 2016 00:07:05 +0000 (UTC) (envelope-from andrew@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B7AF1139A; Mon, 18 Jan 2016 00:07:05 +0000 (UTC) (envelope-from andrew@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u0I074Or026052; Mon, 18 Jan 2016 00:07:04 GMT (envelope-from andrew@FreeBSD.org) Received: (from andrew@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u0I074dX026051; Mon, 18 Jan 2016 00:07:04 GMT (envelope-from andrew@FreeBSD.org) Message-Id: <201601180007.u0I074dX026051@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: andrew set sender to andrew@FreeBSD.org using -f From: Andrew Turner Date: Mon, 18 Jan 2016 00:07:04 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r294238 - head/sys/arm/arm X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jan 2016 00:07:06 -0000 Author: andrew Date: Mon Jan 18 00:07:04 2016 New Revision: 294238 URL: https://svnweb.freebsd.org/changeset/base/294238 Log: Add extra checks to make sure the size is valid. We may get an integer underflow when we have small blocks of memory at the start and end of the 32-bit address range. While here, only insert mappings pointing at a non-zero amount of memory. Sponsored by: ABT Systems Ltd Modified: head/sys/arm/arm/physmem.c Modified: head/sys/arm/arm/physmem.c ============================================================================== --- head/sys/arm/arm/physmem.c Sun Jan 17 23:03:21 2016 (r294237) +++ head/sys/arm/arm/physmem.c Mon Jan 18 00:07:04 2016 (r294238) @@ -292,9 +292,13 @@ arm_physmem_hardware_region(vm_paddr_t p * than leave some folks with an unusable system while we investigate. */ if (pa == 0) { + if (sz <= PAGE_SIZE) + return; pa = PAGE_SIZE; sz -= PAGE_SIZE; } else if (pa + sz == 0) { + if (sz <= 1024 * 1024) + return; sz -= 1024 * 1024; } @@ -306,7 +310,7 @@ arm_physmem_hardware_region(vm_paddr_t p pa = round_page(pa); sz = trunc_page(sz - adj); - if (hwcnt < nitems(hwregions)) + if (sz > 0 && hwcnt < nitems(hwregions)) insert_region(hwregions, hwcnt++, pa, sz, 0); }