svn commit: r328675 - stable/11/sys/dev/nvme

[Alexander Motin]

Author: mav
Date: Thu Feb  1 16:24:03 2018
New Revision: 328675
URL: https://svnweb.freebsd.org/changeset/base/328675

Log:
  MFC r313113 (by imp):
  Ensure that the passthrough request will fit in MAXPHYS bytes after it
  has been rounded to full pages. This avoids a panic in
  vm_fault_quick_hold_pages due to this off-by-one error passing one
  page too many into vmapbuf.

Modified:
  stable/11/sys/dev/nvme/nvme_ctrlr.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/nvme/nvme_ctrlr.c
==============================================================================
--- stable/11/sys/dev/nvme/nvme_ctrlr.c	Thu Feb  1 16:22:28 2018	(r328674)
+++ stable/11/sys/dev/nvme/nvme_ctrlr.c	Thu Feb  1 16:24:03 2018	(r328675)
@@ -874,8 +874,20 @@ nvme_ctrlr_passthrough_cmd(struct nvme_controller *ctr
 	struct mtx		*mtx;
 	struct buf		*buf = NULL;
 	int			ret = 0;
+	vm_offset_t		addr, end;
 
 	if (pt->len > 0) {
+		/*
+		 * vmapbuf calls vm_fault_quick_hold_pages which only maps full
+		 * pages. Ensure this request has fewer than MAXPHYS bytes when
+		 * extended to full pages.
+		 */
+		addr = (vm_offset_t)pt->buf;
+		end = round_page(addr + pt->len);
+		addr = trunc_page(addr);
+		if (end - addr > MAXPHYS)
+			return EIO;
+
 		if (pt->len > ctrlr->max_xfer_size) {
 			nvme_printf(ctrlr, "pt->len (%d) "
 			    "exceeds max_xfer_size (%d)\n", pt->len,