From: mpi <mpi@openbsd.org>
Date: Tue, 21 Dec 2021 22:21:32 +0000 (+0000)
Subject: Fix a typo in mlock(2) error path triggering a double-free.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=65315d4d4359323af4f23f6d8d3db7f0dfa1e7bc;p=openbsd

Fix a typo in mlock(2) error path triggering a double-free.

Pass the correct entry to uvm_fault_unwire_locked().

Reported-by: syzbot+bb2f63f076618e9ed0d3@syzkaller.appspotmail.com

ok kettenis@, deraadt@
---

diff --git a/sys/uvm/uvm_map.c b/sys/uvm/uvm_map.c
index d4e420d4c1e..c931418f753 100644
--- a/sys/uvm/uvm_map.c
+++ b/sys/uvm/uvm_map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_map.c,v 1.281 2021/12/15 12:53:53 mpi Exp $	*/
+/*	$OpenBSD: uvm_map.c,v 1.282 2021/12/21 22:21:32 mpi Exp $	*/
 /*	$NetBSD: uvm_map.c,v 1.86 2000/11/27 08:40:03 chs Exp $	*/
 
 /*
@@ -2420,7 +2420,7 @@ uvm_map_pageable_wire(struct vm_map *map, struct vm_map_entry *first,
 			first->wired_count--;
 			if (!VM_MAPENT_ISWIRED(first)) {
 				uvm_fault_unwire_locked(map,
-				    iter->start, iter->end);
+				    first->start, first->end);
 			}
 		}