From 22d9a23207f367de66d777186bd16cded516c5a2 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Mon, 22 Jun 2026 14:51:27 -0400 Subject: [PATCH] kernel/device_manager: Add some missing checks in DMAResource::TranslateNext. * Ensure memory is locked before doing virtual->physical translation. * Make sure get_memory_map_etc actually returned an entry. I didn't see either of these trip in some basic testing though. --- src/system/kernel/device_manager/dma_resources.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/system/kernel/device_manager/dma_resources.cpp b/src/system/kernel/device_manager/dma_resources.cpp index 62b712218a..7c24d4c41e 100644 --- a/src/system/kernel/device_manager/dma_resources.cpp +++ b/src/system/kernel/device_manager/dma_resources.cpp @@ -437,6 +437,8 @@ DMAResource::TranslateNext(IORequest* request, IOOperation* operation, offset, request->RemainingBytes(), fBlockSize, partialBegin); if (buffer->IsVirtual()) { + ASSERT(buffer->IsMemoryLocked()); + // Unless we need the bounce buffer anyway, we have to translate the // virtual addresses to physical addresses, so we can check the DMA // restrictions. @@ -460,8 +462,10 @@ DMAResource::TranslateNext(IORequest* request, IOOperation* operation, < fRestrictions.max_segment_count) { physical_entry entry; uint32 count = 1; - get_memory_map_etc(request->TeamID(), (void*)base, size, - &entry, &count); + get_memory_map_etc(request->TeamID(), + (void*)base, size, &entry, &count); + if (count != 1) + return B_ERROR; vecs[segmentCount].base = entry.address; vecs[segmentCount].length = entry.size;