diff options
| author | jmg <jmg@FreeBSD.org> | 2013-09-25 02:48:12 +0000 |
|---|---|---|
| committer | jmg <jmg@FreeBSD.org> | 2013-09-25 02:48:12 +0000 |
| commit | 903f65948b7ea2da43e3376963ac490985695832 (patch) | |
| tree | 68cc19aada915ed93bfe74b0095bfb9807fe6072 /sys/fs/cd9660 | |
| parent | d965f28ba1171a60f27bd8b0e21de9412e2640f2 (diff) | |
| download | FreeBSD-src-903f65948b7ea2da43e3376963ac490985695832.zip FreeBSD-src-903f65948b7ea2da43e3376963ac490985695832.tar.gz | |
fix a bug where we access a bread buffer after we have brelse'd it...
The kernel normally didn't unmap/context switch away before we accessed
the buffer most of the time, but under heavy I/O pressure and lots of
mount/unmounting this would cause a fault on nofault panic...
Reviewed by: dteske
Approved by: re (kib)
Sponsored by: Vicor
MFC after: 3 days
Diffstat (limited to 'sys/fs/cd9660')
| -rw-r--r-- | sys/fs/cd9660/cd9660_vfsops.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/fs/cd9660/cd9660_vfsops.c b/sys/fs/cd9660/cd9660_vfsops.c index 1865202..87657ab 100644 --- a/sys/fs/cd9660/cd9660_vfsops.c +++ b/sys/fs/cd9660/cd9660_vfsops.c @@ -390,11 +390,11 @@ iso_mountfs(devvp, mp) /* Check the Rock Ridge Extension support */ if (!(isomp->im_flags & ISOFSMNT_NORRIP)) { - if ((error = bread(isomp->im_devvp, - (isomp->root_extent + isonum_711(rootp->ext_attr_length)) << - (isomp->im_bshift - DEV_BSHIFT), - isomp->logical_block_size, NOCRED, &bp)) != 0) - goto out; + if ((error = bread(isomp->im_devvp, (isomp->root_extent + + isonum_711(((struct iso_directory_record *)isomp->root)-> + ext_attr_length)) << (isomp->im_bshift - DEV_BSHIFT), + isomp->logical_block_size, NOCRED, &bp)) != 0) + goto out; rootp = (struct iso_directory_record *)bp->b_data; |
