From owner-cvs-all  Sun Dec 12 18:55:52 1999
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 2C3E714CA0; Sun, 12 Dec 1999 18:55:50 -0800 (PST)
	(envelope-from tegge@FreeBSD.org)
Received: (from tegge@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id SAA67596;
	Sun, 12 Dec 1999 18:55:49 -0800 (PST)
	(envelope-from tegge@FreeBSD.org)
Message-Id: <199912130255.SAA67596@freefall.freebsd.org>
From: Tor Egge <tegge@FreeBSD.org>
Date: Sun, 12 Dec 1999 18:55:49 -0800 (PST)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/kern sys_pipe.c
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk

tegge       1999/12/12 18:55:49 PST

  Modified files:
    sys/kern             sys_pipe.c 
  Log:
  Fix two problems with pipe_write():
  
   1. Data written beyond end of pipe buffer, causing kernel memory corruption.
  
      - Check that space is still valid after obtaining the pipe lock.
  
      - Defer the calculation of transfer size until the pipe
        lock has been obtained.
  
      - Update the pipe buffer pointers while holding the pipe lock.
  
   2. Writes of size <= PIPE_BUF not always atomic.
  
      - Allow an internal write to span two contiguous segments,
        so writes of size <= PIPE_BUF can be kept atomic
        when wrapping around from the end to the start of the
        pipe buffer.
  
  PR:		15235
  Reviewed by:	Matt Dillon <dillon@FreeBSD.org>
  
  Revision  Changes    Path
  1.59      +65 -24    src/sys/kern/sys_pipe.c



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message