diff options
| author | kib <kib@FreeBSD.org> | 2016-02-17 19:39:57 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2016-02-17 19:39:57 +0000 |
| commit | a5f88cf93faec476bfcd6a7b8a86d9a1962e4746 (patch) | |
| tree | a1262b8ba07f2d7b6c0a005ea00b6b6e5911b4cb /sys/kern | |
| parent | 3e8aeb49a91e40523d3170cbf33224dacff8858b (diff) | |
| download | FreeBSD-src-a5f88cf93faec476bfcd6a7b8a86d9a1962e4746.zip FreeBSD-src-a5f88cf93faec476bfcd6a7b8a86d9a1962e4746.tar.gz | |
In bnoreuselist(), check both ends of the specified logical block
numbers range.
This effectively skips indirect and extdata blocks on the buffer
queue. Since their logical block numbers are negative, bnoreuselist()
could loop infinitely.
Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/vfs_subr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c index b420c84..eaa4980 100644 --- a/sys/kern/vfs_subr.c +++ b/sys/kern/vfs_subr.c @@ -1673,7 +1673,8 @@ bnoreuselist(struct bufv *bufv, struct bufobj *bo, daddr_t startn, daddr_t endn) for (lblkno = startn;;) { again: bp = BUF_PCTRIE_LOOKUP_GE(&bufv->bv_root, lblkno); - if (bp == NULL || bp->b_lblkno >= endn) + if (bp == NULL || bp->b_lblkno >= endn || + bp->b_lblkno < startn) break; error = BUF_TIMELOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL | LK_INTERLOCK, BO_LOCKPTR(bo), "brlsfl", 0, 0); |
