the bitrig pedro_bwrite branch has been created by pedro.

it is 0 commits behind master, and 1 commit ahead.

commit d06783b09b54ebd7e9965f988c44f83c2f4be77c
diff: https://github.com/bitrig/bitrig/commit/d06783b
author: pedro martelletto <[email protected]>
date: Thu Jan 1 13:50:36 2015 +0100

fix race condition in bwrite()

in bwrite(), don't inspect b_bq after calling VOP_STRATEGY() and
lowering the IPL. at that point we no longer own the buffer, so it is
possible for the issued i/o to complete between the moment we check if
b_bq is set and the subsequent call to bufq_wait(), leading to a null
pointer dereference in the latter function, as observed empirically this
morning on my amd64 running dpb -p 8.

M       sys/kern/kern_bufq.c
M       sys/kern/vfs_bio.c
M       sys/sys/buf.h

Reply via email to