⬢ DragonFlyBSD Kernel Audit
DF-0089 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
diff --git a/sys/kern/subr_rman.c b/sys/kern/subr_rman.c
--- a/sys/kern/subr_rman.c
+++ b/sys/kern/subr_rman.c
@@ -561,7 +561,9 @@
 	t = TAILQ_NEXT(r, r_link);
 
 	if (s != NULL && (s->r_flags & RF_ALLOCATED) == 0
-	    && t != NULL && (t->r_flags & RF_ALLOCATED) == 0) {
+	    && t != NULL && (t->r_flags & RF_ALLOCATED) == 0
+	    && s->r_end + 1 == r->r_start
+	    && r->r_end + 1 == t->r_start) {
 		/*
 		 * Merge all three segments.
 		 */
@@ -569,13 +571,15 @@
 		TAILQ_REMOVE(&rm->rm_list, r, r_link);
 		TAILQ_REMOVE(&rm->rm_list, t, r_link);
 		kfree(t, M_RMAN);
-	} else if (s != NULL && (s->r_flags & RF_ALLOCATED) == 0) {
+	} else if (s != NULL && (s->r_flags & RF_ALLOCATED) == 0
+	    && s->r_end + 1 == r->r_start) {
 		/*
 		 * Merge previous segment with ours.
 		 */
 		s->r_end = r->r_end;
 		TAILQ_REMOVE(&rm->rm_list, r, r_link);
-	} else if (t != NULL && (t->r_flags & RF_ALLOCATED) == 0) {
+	} else if (t != NULL && (t->r_flags & RF_ALLOCATED) == 0
+	    && r->r_end + 1 == t->r_start) {
 		/*
 		 * Merge next segment with ours.
 		 */