Date: Sat, 24 Apr 1999 10:37:14 -0700 (PDT) From: will@iki.fi To: freebsd-gnats-submit@freebsd.org Subject: kern/11307: Variable wraparound in kern/vfs_cache.c:cache_purge can cause lockup Message-ID: <19990424173714.DE82515168@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 11307 >Category: kern >Synopsis: Variable wraparound in kern/vfs_cache.c:cache_purge can cause lockup >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Apr 24 10:40:00 PDT 1999 >Closed-Date: >Last-Modified: >Originator: Ville-Pertti Keinonen >Release: Versions 3.0/3.1 and -current are affected. >Organization: >Environment: >Description: In versions of kern/vfs_cache.c starting with 1.31, the loop to find a usable 'nextid' in cache_purge doesn't increment nextid, so if the loop condition fails (e.g. if nextid is zero -- like it is after it wraps), it loops forever. I tried mailing phk (who introduced the bug and is, I believe, the man behind the "new" namecache code) a couple of days ago and received an error from his fetchmail-daemon, so I don't know if he got the message. The comment above cache_purge is also a bit out-of-date (it describes what the code used to do), as are most of the comments in vfs_cache.c... >How-To-Repeat: >Fix: Increment nextid in the loop in addition to incrementing it before the loop or use a do nextid++ while (old conditions); loop structure. >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990424173714.DE82515168>