From owner-svn-src-all@FreeBSD.ORG Sat Mar 22 11:49:45 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A0891245; Sat, 22 Mar 2014 11:49:45 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 72DFC3E5; Sat, 22 Mar 2014 11:49:45 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s2MBnjPD080812; Sat, 22 Mar 2014 11:49:45 GMT (envelope-from mckusick@svn.freebsd.org) Received: (from mckusick@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s2MBnjVK080807; Sat, 22 Mar 2014 11:49:45 GMT (envelope-from mckusick@svn.freebsd.org) Message-Id: <201403221149.s2MBnjVK080807@svn.freebsd.org> From: Kirk McKusick Date: Sat, 22 Mar 2014 11:49:45 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r263630 - stable/9/sbin/fsck_ffs X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Mar 2014 11:49:45 -0000 Author: mckusick Date: Sat Mar 22 11:49:44 2014 New Revision: 263630 URL: http://svnweb.freebsd.org/changeset/base/263630 Log: MFC of 263062: Avoid segment fault when attempting to clean up cylinder group buffer cache. PR: 187221 Submitted by: Petr Lampa Obtained from: Petr Lampa MFC after: 1 week MFC of 262488: Arguments for malloc and calloc should be size_t, not int. Use proper bounds check when trying to free cached memory. Spotted by: Xin Li Tested by: Dmitry Sivachenko MFC after: 2 weeks Modified: stable/9/sbin/fsck_ffs/fsck.h stable/9/sbin/fsck_ffs/fsutil.c Directory Properties: stable/9/ (props changed) stable/9/sbin/ (props changed) stable/9/sbin/fsck_ffs/ (props changed) stable/9/sbin/ggate/ (props changed) Modified: stable/9/sbin/fsck_ffs/fsck.h ============================================================================== --- stable/9/sbin/fsck_ffs/fsck.h Sat Mar 22 11:43:35 2014 (r263629) +++ stable/9/sbin/fsck_ffs/fsck.h Sat Mar 22 11:49:44 2014 (r263630) @@ -366,7 +366,7 @@ int flushentry(void); * to get space. */ static inline void* -Malloc(int size) +Malloc(size_t size) { void *retval; @@ -381,7 +381,7 @@ Malloc(int size) * to get space. */ static inline void* -Calloc(int cnt, int size) +Calloc(size_t cnt, size_t size) { void *retval; Modified: stable/9/sbin/fsck_ffs/fsutil.c ============================================================================== --- stable/9/sbin/fsck_ffs/fsutil.c Sat Mar 22 11:43:35 2014 (r263629) +++ stable/9/sbin/fsck_ffs/fsutil.c Sat Mar 22 11:49:44 2014 (r263630) @@ -205,7 +205,7 @@ cgget(int cg) struct cg *cgp; if (cgbufs == NULL) { - cgbufs = Calloc(sblock.fs_ncg, sizeof(struct bufarea)); + cgbufs = calloc(sblock.fs_ncg, sizeof(struct bufarea)); if (cgbufs == NULL) errx(EEXIT, "cannot allocate cylinder group buffers"); } @@ -234,6 +234,8 @@ flushentry(void) { struct bufarea *cgbp; + if (flushtries == sblock.fs_ncg || cgbufs == NULL) + return (0); cgbp = &cgbufs[flushtries++]; if (cgbp->b_un.b_cg == NULL) return (0); @@ -414,13 +416,15 @@ ckfini(int markclean) } if (numbufs != cnt) errx(EEXIT, "panic: lost %d buffers", numbufs - cnt); - for (cnt = 0; cnt < sblock.fs_ncg; cnt++) { - if (cgbufs[cnt].b_un.b_cg == NULL) - continue; - flush(fswritefd, &cgbufs[cnt]); - free(cgbufs[cnt].b_un.b_cg); + if (cgbufs != NULL) { + for (cnt = 0; cnt < sblock.fs_ncg; cnt++) { + if (cgbufs[cnt].b_un.b_cg == NULL) + continue; + flush(fswritefd, &cgbufs[cnt]); + free(cgbufs[cnt].b_un.b_cg); + } + free(cgbufs); } - free(cgbufs); pbp = pdirbp = (struct bufarea *)0; if (cursnapshot == 0 && sblock.fs_clean != markclean) { if ((sblock.fs_clean = markclean) != 0) {