DragonFlyBSD Kernel Audit
DF-0955 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vm/vm_contig.c b/sys/vm/vm_contig.c
--- a/sys/vm/vm_contig.c
+++ b/sys/vm/vm_contig.c
@@ -399,8 +399,16 @@
 			m = &pga[i];
 
 			if (vm_page_busy_try(m, TRUE)) {
-				vm_contig_pg_free(start,
-						  (i - start) * PAGE_SIZE);
+				/*
+				 * DF-0955: on the first iteration (i == start)
+				 * (i - start) * PAGE_SIZE == 0, which
+				 * vm_contig_pg_free() would panic on.  Guard
+				 * the call so we only free what we actually
+				 * allocated.
+				 */
+				if (i > start)
+					vm_contig_pg_free(start,
+							  (i - start) * PAGE_SIZE);
 				start++;
 				goto again;
 			}
@@ -419,8 +427,12 @@
 			}
 			if (pqtype != PQ_FREE || m->hold_count) {
 				vm_page_wakeup(m);
-				vm_contig_pg_free(start,
-						  (i - start) * PAGE_SIZE);
+				/*
+				 * DF-0955: same i == start guard as above.
+				 */
+				if (i > start)
+					vm_contig_pg_free(start,
+							  (i - start) * PAGE_SIZE);
 				start++;
 				goto again;
 			}