d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Since buffers can be pulled off of the disk queue at interrupt time and

Browse Source 
disksort is called at non-interrupt time and can be actively traversing
the list when that happens, there is a very small window of vulnerability.
Close it by protecting disksort with splbio().
This commit is contained in:
David Greenman 1995-08-07 11:55:32 +00:00
parent b4224c9c6c
commit 5d210d3fd4
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=9982
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/kern/subr_disklabel.c
View File

@ -42,7 +42,7 @@
* SUCH DAMAGE.
*
* @(#)ufs_disksubr.c 8.5 (Berkeley) 1/21/94
* $Id: ufs_disksubr.c,v 1.14 1995/03/18 07:06:51 davidg Exp $
* $Id: ufs_disksubr.c,v 1.15 1995/05/30 08:15:33 rgrimes Exp $
*/
#include <sys/param.h>
@ -80,11 +80,14 @@ disksort(ap, bp)
register struct buf *ap, *bp;
{
register struct buf *bq;
int s;
s = splbio();
/* If the queue is empty, then it's easy. */
if (ap->b_actf == NULL) {
bp->b_actf = NULL;
ap->b_actf = bp;
splx(s);
return;
}
@ -142,8 +145,10 @@ disksort(ap, bp)
* Neither a second list nor a larger request... we go at the end of
* the first list, which is the same as the end of the whole schebang.
*/
insert: bp->b_actf = bq->b_actf;
insert:
bp->b_actf = bq->b_actf;
bq->b_actf = bp;
splx(s);
}
/*

9
sys/ufs/ufs/ufs_disksubr.c
View File

@ -42,7 +42,7 @@
* SUCH DAMAGE.
*
* @(#)ufs_disksubr.c 8.5 (Berkeley) 1/21/94
* $Id: ufs_disksubr.c,v 1.14 1995/03/18 07:06:51 davidg Exp $
* $Id: ufs_disksubr.c,v 1.15 1995/05/30 08:15:33 rgrimes Exp $
*/
#include <sys/param.h>
@ -80,11 +80,14 @@ disksort(ap, bp)
register struct buf *ap, *bp;
{
register struct buf *bq;
int s;
s = splbio();
/* If the queue is empty, then it's easy. */
if (ap->b_actf == NULL) {
bp->b_actf = NULL;
ap->b_actf = bp;
splx(s);
return;
}
@ -142,8 +145,10 @@ disksort(ap, bp)
* Neither a second list nor a larger request... we go at the end of
* the first list, which is the same as the end of the whole schebang.
*/
insert: bp->b_actf = bq->b_actf;
insert:
bp->b_actf = bq->b_actf;
bq->b_actf = bp;
splx(s);
}
/*