From owner-freebsd-net  Mon Mar 18 15:57:42 2002
Delivered-To: freebsd-net@freebsd.org
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by hub.freebsd.org (Postfix) with SMTP
	id B781837B400; Mon, 18 Mar 2002 15:57:31 -0800 (PST)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa63120@salmon>; 18 Mar 2002 23:57:30 +0000 (GMT)
To: Josef Karthauser <joe@tao.org.uk>
Cc: W Alexander Hagen <aligzanduh@yahoo.com>,
	freebsd-net@freebsd.org, jedgar@freebsd.org,
	Eugene Grosbein <eugen@grosbein.pp.ru>, freebsd-stable@freebsd.org
Subject: Re: Freebsd REL_ENG 4.3 p28 freezes every 30 minutes. 
In-Reply-To: Your message of "Mon, 18 Mar 2002 23:04:52 GMT."
             <20020318230452.GC83798@genius.tao.org.uk> 
Date: Mon, 18 Mar 2002 23:57:30 +0000
From: Ian Dowse <iedowse@maths.tcd.ie>
Message-ID:  <200203182357.aa63120@salmon.maths.tcd.ie>
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org

In message <20020318230452.GC83798@genius.tao.org.uk>, Josef Karthauser writes:
>The revision level of what?  Every file has it's own revision level, and
>there isn't a global revision number for the whole system.  How are you
>getting the p28 number?

He means RELENG_4_3 patch level 28, which is the most recent security
patch on that branch (approx 10 days ago).

There have been a few reports now (see also kern/35969) of crashes
that seem to correspond to the kernel zlib error-handling fix (it
is RELENG_4_3 patch 27). Maybe it has some problems? Actually, just
looking at the patch, I think it does...

The patch moves the position of one of the

	ZFREE(z, s->sub.trees.blens);

lines to after

	s->sub.decode.codes = c;

but s->sub is a union, and s->sub.trees.blens aliases s->sub.decode.codes
(on the i386 anyway), so the patch completely changes the behaviour.

Could someone seeing crashes since this "fix" try the following
patch?

Ian

Index: /usr/src/sys/net/zlib.c
===================================================================
RCS file: /dump/FreeBSD-CVS/src/sys/net/zlib.c,v
retrieving revision 1.11
diff -u -r1.11 zlib.c
--- /usr/src/sys/net/zlib.c	17 Feb 2002 17:35:18 -0000	1.11
+++ /usr/src/sys/net/zlib.c	18 Mar 2002 23:48:08 -0000
@@ -3951,11 +3951,11 @@
           r = Z_MEM_ERROR;
           LEAVE
         }
+        ZFREE(z, s->sub.trees.blens);
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;
       }
-      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message