Wed May 27 21:42:08 2009 UTC ()

Pull up following revision(s) (requested by hannken in ticket #781):
	sys/kern/kern_physio.c: revision 1.91
PR kern/39536: bufq related problem when writing DVDR and DVDRWs.
Remove a race where physio_done() may use memory already freed.
Observed by Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>.


(snj)

diff -r1.88 -r1.88.4.1 src/sys/kern/kern_physio.c

--- src/sys/kern/kern_physio.c 2008/09/24 08:19:19	1.88
+++ src/sys/kern/kern_physio.c 2009/05/27 21:42:08	1.88.4.1

 @@ -1,14 +1,14 @@
-/*	$NetBSD: kern_physio.c,v 1.88 2008/09/24 08:19:19 hannken Exp $	*/
+/*	$NetBSD: kern_physio.c,v 1.88.4.1 2009/05/27 21:42:08 snj Exp $	*/
 /*-
  * Copyright (c) 1982, 1986, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  * (c) UNIX System Laboratories, Inc.
  * All or some portions of this file are derived from material licensed
  * to the University of California by American Telephone and Telegraph
  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
  * the permission of UNIX System Laboratories, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -61,27 +61,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)kern_physio.c	8.1 (Berkeley) 6/10/93
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_physio.c,v 1.88 2008/09/24 08:19:19 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_physio.c,v 1.88.4.1 2009/05/27 21:42:08 snj Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/buf.h>
 #include <sys/proc.h>
 #include <sys/once.h>
 #include <sys/workqueue.h>
 #include <sys/kmem.h>
 #include <uvm/uvm_extern.h>
 ONCE_DECL(physio_initialized);
 struct workqueue *physio_workqueue;
 @@ -107,37 +107,39 @@ struct physio_stat {
 	off_t ps_endoffset;
 	buf_t *ps_orig_bp;
 	kmutex_t ps_lock;
 	kcondvar_t ps_cv;
 };
 static void
 physio_done(struct work *wk, void *dummy)
+{
 	struct buf *bp = (void *)wk;
 	size_t todo = bp->b_bufsize;
 	size_t done = bp->b_bcount - bp->b_resid;
 	struct physio_stat *ps = bp->b_private;
 	bool is_iobuf;
 	KASSERT(&bp->b_work == wk);
 	KASSERT(bp->b_bcount <= todo);
 	KASSERT(bp->b_resid <= bp->b_bcount);
 	KASSERT((bp->b_flags & B_PHYS) != 0);
 	KASSERT(dummy == NULL);
 	vunmapbuf(bp, todo);
 	uvm_vsunlock(bp->b_proc->p_vmspace, bp->b_data, todo);
 	mutex_enter(&ps->ps_lock);
 	is_iobuf = (bp != ps->ps_orig_bp);
 	if (__predict_false(done != todo)) {
 		off_t endoffset = dbtob(bp->b_blkno) + done;
 		/*
 		 * we got an error or hit EOM.
+		 *
 		 * we only care about the first one.
 		 * ie. the one at the lowest offset.
 		 */
 		KASSERT(ps->ps_endoffset != endoffset);
 		DPRINTF(("%s: error=%d at %" PRIu64 " - %" PRIu64
 		    ", blkno=%" PRIu64 ", bcount=%d, flags=0x%x\n",
 @@ -153,27 +155,27 @@ physio_done(struct work *wk, void *dummy
 			ps->ps_endoffset = endoffset;
 			ps->ps_error = bp->b_error;
+		}
 		ps->ps_failed++;
 	} else {
 		KASSERT(bp->b_error == 0);
+	}
 	ps->ps_running--;
 	cv_signal(&ps->ps_cv);
 	mutex_exit(&ps->ps_lock);
-	if (bp != ps->ps_orig_bp)
+	if (is_iobuf)
 		putiobuf(bp);
+}
 static void
 physio_biodone(struct buf *bp)
+{
 #if defined(DIAGNOSTIC)
 	struct physio_stat *ps = bp->b_private;
 	size_t todo = bp->b_bufsize;
 	KASSERT(ps->ps_running > 0);
 	KASSERT(bp->b_bcount <= todo);
 	KASSERT(bp->b_resid <= bp->b_bcount);