From owner-freebsd-bugs  Tue Aug 26 08:20:15 1997
Return-Path: <owner-freebsd-bugs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id IAA16484
          for bugs-outgoing; Tue, 26 Aug 1997 08:20:15 -0700 (PDT)
Received: (from gnats@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id IAA16416;
          Tue, 26 Aug 1997 08:20:07 -0700 (PDT)
Resent-Date: Tue, 26 Aug 1997 08:20:07 -0700 (PDT)
Resent-Message-Id: <199708261520.IAA16416@hub.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@FreeBSD.ORG, dima@tejblum.dnttm.rssi.ru
Received: from helios.dnttm.ru (root@dnttm.wave.ras.ru [194.85.104.197])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id IAA16198;
          Tue, 26 Aug 1997 08:17:49 -0700 (PDT)
Received: (from uucp@localhost)
	by helios.dnttm.ru (8.8.5/8.8.5/IP-3) with UUCP id TAA21355;
	Tue, 26 Aug 1997 19:16:18 +0400
Received: (from dima@localhost)
	by tejblum.dnttm.rssi.ru (8.8.7/8.8.5) id TAA00687;
	Tue, 26 Aug 1997 19:11:03 +0400 (MSD)
Message-Id: <199708261511.TAA00687@tejblum.dnttm.rssi.ru>
Date: Tue, 26 Aug 1997 19:11:03 +0400 (MSD)
From: Dmitrij Tejblum <dima@tejblum.dnttm.rssi.ru>
Reply-To: dima@tejblum.dnttm.rssi.ru
To: FreeBSD-gnats-submit@FreeBSD.ORG
Cc: julian@FreeBSD.ORG
X-Send-Pr-Version: 3.2
Subject: kern/4397: DEVFS trashes memory in umount
Sender: owner-freebsd-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         4397
>Category:       kern
>Synopsis:       DEVFS trashes memory in umount
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 26 08:20:03 PDT 1997
>Last-Modified:
>Originator:     Dmitrij Tejblum
>Organization:
>Release:        FreeBSD 3.0-CURRENT i386
>Environment:


>Description:

List of links to one device is not properly linked. This caused memory trash
when the list is destroyed.

>How-To-Repeat:

unmount DEVFS and then mount it again. You may see message 
'Data modified on freelist' printed on console.

>Fix:
	
--- devfs_tree.c.02	Tue Aug 26 00:44:04 1997
+++ devfs_tree.c	Tue Aug 26 00:51:07 1997
@@ -271,6 +271,7 @@
 		devnmp->nextlink = dnp->linklist;
 		devnmp->prevlinkp = devnmp->nextlink->prevlinkp;
 		devnmp->nextlink->prevlinkp = &(devnmp->nextlink);
+		*devnmp->prevlinkp = devnmp;
 		dnp->linklist = devnmp;
 	} else {
 		devnmp->nextlink = devnmp;

>Audit-Trail:
>Unformatted: