svn commit: r361568 - head/sys/powerpc/aim

[Brandon Bergren]

Author: bdragon
Date: Thu May 28 00:49:02 2020
New Revision: 361568
URL: https://svnweb.freebsd.org/changeset/base/361568

Log:
  [PowerPC] Fix radix crash when passing -1 from userspace
  
  Found by running libc tests with radix enabled.
  
  Detect unsigned integer wrapping with a postcondition.
  
  Note: Radix MMU is not enabled by default yet.
  
  Sponsored by:	Tag1 Consulting, Inc.

Modified:
  head/sys/powerpc/aim/mmu_radix.c

Modified: head/sys/powerpc/aim/mmu_radix.c
==============================================================================
--- head/sys/powerpc/aim/mmu_radix.c	Wed May 27 23:20:35 2020	(r361567)
+++ head/sys/powerpc/aim/mmu_radix.c	Thu May 28 00:49:02 2020	(r361568)
@@ -6000,7 +6000,8 @@ mmu_radix_kremove(vm_offset_t va)
 int mmu_radix_map_user_ptr(pmap_t pm,
     volatile const void *uaddr, void **kaddr, size_t ulen, size_t *klen)
 {
-	if ((uintptr_t)uaddr + ulen >= VM_MAXUSER_ADDRESS)
+	if ((uintptr_t)uaddr + ulen >= VM_MAXUSER_ADDRESS ||
+	    (uintptr_t)uaddr + ulen < (uintptr_t)uaddr)
 		return (EFAULT);
 
 	*kaddr = (void *)(uintptr_t)uaddr;