1 files changed, 15 insertions, 14 deletions

diff --git a/sys/arm64/vmm/vmm_dev.c b/sys/arm64/vmm/vmm_dev.c
index 9f405384f2b3..946c6760f7c1 100644
--- a/sys/arm64/vmm/vmm_dev.c
+++ b/sys/arm64/vmm/vmm_dev.c
@@ -102,10 +102,7 @@ vmm_priv_check(struct ucred *ucred)
 static int
 vcpu_lock_one(struct vcpu *vcpu)
 {
-	int error;
-
-	error = vcpu_set_state(vcpu, VCPU_FROZEN, true);
-	return (error);
+	return (vcpu_set_state(vcpu, VCPU_FROZEN, true));
 }
 
 static void
@@ -252,8 +249,10 @@ vmmdev_rw(struct cdev *cdev, struct uio *uio, int flags)
 	return (error);
 }
 
+CTASSERT(sizeof(((struct vm_memseg *)0)->name) >= VM_MAX_SUFFIXLEN + 1);
+
 static int
-get_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg)
+get_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg, size_t len)
 {
 	struct devmem_softc *dsc;
 	int error;
@@ -270,17 +269,16 @@ get_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg)
 		}
 		KASSERT(dsc != NULL, ("%s: devmem segment %d not found",
 		    __func__, mseg->segid));
-		error = copystr(dsc->name, mseg->name, sizeof(mseg->name),
-		    NULL);
+		error = copystr(dsc->name, mseg->name, len, NULL);
 	} else {
-		bzero(mseg->name, sizeof(mseg->name));
+		bzero(mseg->name, len);
 	}
 
 	return (error);
 }
 
 static int
-alloc_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg)
+alloc_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg, size_t len)
 {
 	char *name;
 	int error;
@@ -296,8 +294,8 @@ alloc_memseg(struct vmmdev_softc *sc, struct vm_memseg *mseg)
 	 */
 	if (VM_MEMSEG_NAME(mseg)) {
 		sysmem = false;
-		name = malloc(sizeof(mseg->name), M_VMMDEV, M_WAITOK);
-		error = copystr(mseg->name, name, sizeof(mseg->name), NULL);
+		name = malloc(len, M_VMMDEV, M_WAITOK);
+		error = copystr(mseg->name, name, len, NULL);
 		if (error)
 			goto done;
 	}
@@ -545,10 +543,12 @@ vmmdev_ioctl(struct cdev *cdev, u_long cmd, caddr_t data, int fflag,
 		error = vm_munmap_memseg(sc->vm, mu->gpa, mu->len);
 		break;
 	case VM_ALLOC_MEMSEG:
-		error = alloc_memseg(sc, (struct vm_memseg *)data);
+		error = alloc_memseg(sc, (struct vm_memseg *)data,
+		    sizeof(((struct vm_memseg *)0)->name));
 		break;
 	case VM_GET_MEMSEG:
-		error = get_memseg(sc, (struct vm_memseg *)data);
+		error = get_memseg(sc, (struct vm_memseg *)data,
+		    sizeof(((struct vm_memseg *)0)->name));
 		break;
 	case VM_GET_REGISTER:
 		vmreg = (struct vm_register *)data;
@@ -994,7 +994,8 @@ devmem_mmap_single(struct cdev *cdev, vm_ooffset_t *offset, vm_size_t len,
 	if (seglen >= last)
 		vm_object_reference(*objp);
 	else
-		error = 0;
+		error = EINVAL;
+
 	vm_unlock_memsegs(dsc->sc->vm);
 	return (error);
 }