From 23456847558f4a9d4a00ebdb005603cf38eac8cf Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Wed, 31 Oct 2007 02:31:51 +0000 Subject: MFC revision 1.389 Correct an error in vm_map_sync(), nee vm_map_clean(), that has existed since revision 1.1. Specifically, neither traversal of the vm map checks whether the end of the vm map has been reached. Consequently, the first traversal can wrap around and bogusly return an error. Approved by: re (kensmith) --- sys/vm/vm_map.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'sys/vm') diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c index cc6628b75451..4b31fb39140c 100644 --- a/sys/vm/vm_map.c +++ b/sys/vm/vm_map.c @@ -2204,7 +2204,8 @@ vm_map_sync( /* * Make a first pass to check for user-wired memory and holes. */ - for (current = entry; current->start < end; current = current->next) { + for (current = entry; current != &map->header && current->start < end; + current = current->next) { if (invalidate && (current->eflags & MAP_ENTRY_USER_WIRED)) { vm_map_unlock_read(map); return (KERN_INVALID_ARGUMENT); @@ -2224,7 +2225,8 @@ vm_map_sync( * Make a second pass, cleaning/uncaching pages from the indicated * objects as we go. */ - for (current = entry; current->start < end; current = current->next) { + for (current = entry; current != &map->header && current->start < end; + current = current->next) { offset = current->offset + (start - current->start); size = (end <= current->end ? end : current->end) - start; if (current->eflags & MAP_ENTRY_IS_SUB_MAP) { -- cgit v1.3