Date: Wed, 25 Sep 2013 02:48:12 +0000 (UTC) From: John-Mark Gurney <jmg@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r255866 - head/sys/fs/cd9660 Message-ID: <201309250248.r8P2mCkX038670@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jmg Date: Wed Sep 25 02:48:12 2013 New Revision: 255866 URL: http://svnweb.freebsd.org/changeset/base/255866 Log: fix a bug where we access a bread buffer after we have brelse'd it... The kernel normally didn't unmap/context switch away before we accessed the buffer most of the time, but under heavy I/O pressure and lots of mount/unmounting this would cause a fault on nofault panic... Reviewed by: dteske Approved by: re (kib) Sponsored by: Vicor MFC after: 3 days Modified: head/sys/fs/cd9660/cd9660_vfsops.c Modified: head/sys/fs/cd9660/cd9660_vfsops.c ============================================================================== --- head/sys/fs/cd9660/cd9660_vfsops.c Wed Sep 25 01:48:45 2013 (r255865) +++ head/sys/fs/cd9660/cd9660_vfsops.c Wed Sep 25 02:48:12 2013 (r255866) @@ -390,11 +390,11 @@ iso_mountfs(devvp, mp) /* Check the Rock Ridge Extension support */ if (!(isomp->im_flags & ISOFSMNT_NORRIP)) { - if ((error = bread(isomp->im_devvp, - (isomp->root_extent + isonum_711(rootp->ext_attr_length)) << - (isomp->im_bshift - DEV_BSHIFT), - isomp->logical_block_size, NOCRED, &bp)) != 0) - goto out; + if ((error = bread(isomp->im_devvp, (isomp->root_extent + + isonum_711(((struct iso_directory_record *)isomp->root)-> + ext_attr_length)) << (isomp->im_bshift - DEV_BSHIFT), + isomp->logical_block_size, NOCRED, &bp)) != 0) + goto out; rootp = (struct iso_directory_record *)bp->b_data;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201309250248.r8P2mCkX038670>