CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/08/09 13:22:49

Modified files:
	sys/kern       : subr_disk.c 

Log message:
Reject d_secsize exceeding MAXPHYS in (init|set)disklabel

readdisklabel() reads one sector into one buffer with
geteblk(d_secsize), and vnd(4) takes d_secsize from userland.  The
buffer cache allocates kva one MAXPHYS slot per buffer but maps and
unmaps b_bufsize worth of it, so an oversize sector lays one buffer
across the slots that follow and unmaps them when it is freed, leaving
other buffer users with a b_data that is no longer mapped.

ok krw@

Reported-by: [email protected]