Date: Wed, 1 Mar 2006 22:12:35 GMT From: Neel Natu <neelnatu@yahoo.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/93998: panic in libstand when closing raw disk device Message-ID: <200603012212.k21MCZEo004077@www.freebsd.org> Resent-Message-ID: <200603012220.k21MK3XW092262@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 93998
>Category: misc
>Synopsis: panic in libstand when closing raw disk device
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Mar 01 22:20:03 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Neel Natu
>Release: 6.0-RELEASE
>Organization:
>Environment:
FreeBSD neel3.silverspringnet.com. 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005 root@x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386
>Description:
We have a modified loader(8) than opens a raw disk partition using libstand open(), reads stuff from it and does a close() on the file descriptor. This close() panics because it tries to free 'f_rabuf'. This is because it has not been initialized in open() for raw disk devices.
>How-To-Repeat:
Not sure how to exercise this from the vanilla loader.
>Fix:
===================================================================
RCS file: /cvsroot/eng/gw/lib/libstand/open.c,v
retrieving revision 1.1.1.1.16.1
retrieving revision 1.2.14.1
diff -u -r1.1.1.1.16.1 -r1.2.14.1
--- open.c 16 Feb 2006 01:44:27 -0000 1.1.1.1.16.1
+++ open.c 18 Feb 2006 06:47:00 -0000 1.2.14.1
@@ -117,6 +117,7 @@
/* see if we opened a raw device; otherwise, 'file' is the file name. */
if (file == (char *)0 || *file == '\0') {
f->f_flags |= F_RAW;
+ f->f_rabuf = NULL;
return (fd);
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200603012212.k21MCZEo004077>