Wed May 27 21:42:08 2009 UTC ()
Pull up following revision(s) (requested by hannken in ticket #781):
	sys/kern/kern_physio.c: revision 1.91
PR kern/39536: bufq related problem when writing DVDR and DVDRWs.
Remove a race where physio_done() may use memory already freed.
Observed by Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>.


(snj)
diff -r1.88 -r1.88.4.1 src/sys/kern/kern_physio.c

cvs diff -r1.88 -r1.88.4.1 src/sys/kern/kern_physio.c (expand / switch to context diff)
--- src/sys/kern/kern_physio.c 2008/09/24 08:19:19 1.88
+++ src/sys/kern/kern_physio.c 2009/05/27 21:42:08 1.88.4.1
@@ -1,4 +1,4 @@
-/*	$NetBSD: kern_physio.c,v 1.88 2008/09/24 08:19:19 hannken Exp $	*/
+/*	$NetBSD: kern_physio.c,v 1.88.4.1 2009/05/27 21:42:08 snj Exp $	*/
 
 /*-
  * Copyright (c) 1982, 1986, 1990, 1993
@@ -71,7 +71,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_physio.c,v 1.88 2008/09/24 08:19:19 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_physio.c,v 1.88.4.1 2009/05/27 21:42:08 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -117,6 +117,7 @@
 	size_t todo = bp->b_bufsize;
 	size_t done = bp->b_bcount - bp->b_resid;
 	struct physio_stat *ps = bp->b_private;
+	bool is_iobuf;
 
 	KASSERT(&bp->b_work == wk);
 	KASSERT(bp->b_bcount <= todo);
@@ -128,6 +129,7 @@
 	uvm_vsunlock(bp->b_proc->p_vmspace, bp->b_data, todo);
 
 	mutex_enter(&ps->ps_lock);
+	is_iobuf = (bp != ps->ps_orig_bp);
 	if (__predict_false(done != todo)) {
 		off_t endoffset = dbtob(bp->b_blkno) + done;
 
@@ -163,7 +165,7 @@
 	cv_signal(&ps->ps_cv);
 	mutex_exit(&ps->ps_lock);
 
-	if (bp != ps->ps_orig_bp)
+	if (is_iobuf)
 		putiobuf(bp);
 }