mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2025-01-11 17:04:19 +01:00
Fixed corruption of the fd buffer queue. Once upon a time, the active
buffer had to be left on the head of the queue for [bufq]disksort() to sort against. This isn't right for devices that can support multiple active i/o's, and only the fd driver did it. "Fixing" this in rev.1.36 of ufs_disksubr.c broke the fd driver in much the same way as rev.1.52 of <sys/buf.h> broke it (see rev.1.119). Bug reported and fix tested by: dt
This commit is contained in:
parent
d75398b55e
commit
e93e63cb39
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=42690
@ -47,7 +47,7 @@
|
|||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
||||||
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
|
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
struct fd_formb *finfo = NULL;
|
struct fd_formb *finfo = NULL;
|
||||||
size_t fdblk;
|
size_t fdblk;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
if(!bp) {
|
if (bp == NULL) {
|
||||||
|
bp = bufq_first(&fdc->head);
|
||||||
|
if (bp != NULL) {
|
||||||
|
bufq_remove(&fdc->head, bp);
|
||||||
|
fdc->bp = bp;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (bp == NULL) {
|
||||||
/***********************************************\
|
/***********************************************\
|
||||||
* nothing left for this controller to do *
|
* nothing left for this controller to do *
|
||||||
* Force into the IDLE state, *
|
* Force into the IDLE state, *
|
||||||
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
{
|
{
|
||||||
/* ALL DONE */
|
/* ALL DONE */
|
||||||
fd->skip = 0;
|
fd->skip = 0;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fd->device_stats,
|
devstat_end_transaction(&fd->device_stats,
|
||||||
bp->b_bcount - bp->b_resid,
|
bp->b_bcount - bp->b_resid,
|
||||||
@ -2026,7 +2033,7 @@ retrier(fdcu)
|
|||||||
fdc_p fdc = fdc_data + fdcu;
|
fdc_p fdc = fdc_data + fdcu;
|
||||||
register struct buf *bp;
|
register struct buf *bp;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
|
|
||||||
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
||||||
goto fail;
|
goto fail;
|
||||||
@ -2070,7 +2077,7 @@ retrier(fdcu)
|
|||||||
bp->b_flags |= B_ERROR;
|
bp->b_flags |= B_ERROR;
|
||||||
bp->b_error = EIO;
|
bp->b_error = EIO;
|
||||||
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
|
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fdc->fd->device_stats,
|
devstat_end_transaction(&fdc->fd->device_stats,
|
||||||
|
@ -47,7 +47,7 @@
|
|||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
||||||
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
|
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
struct fd_formb *finfo = NULL;
|
struct fd_formb *finfo = NULL;
|
||||||
size_t fdblk;
|
size_t fdblk;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
if(!bp) {
|
if (bp == NULL) {
|
||||||
|
bp = bufq_first(&fdc->head);
|
||||||
|
if (bp != NULL) {
|
||||||
|
bufq_remove(&fdc->head, bp);
|
||||||
|
fdc->bp = bp;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (bp == NULL) {
|
||||||
/***********************************************\
|
/***********************************************\
|
||||||
* nothing left for this controller to do *
|
* nothing left for this controller to do *
|
||||||
* Force into the IDLE state, *
|
* Force into the IDLE state, *
|
||||||
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
{
|
{
|
||||||
/* ALL DONE */
|
/* ALL DONE */
|
||||||
fd->skip = 0;
|
fd->skip = 0;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fd->device_stats,
|
devstat_end_transaction(&fd->device_stats,
|
||||||
bp->b_bcount - bp->b_resid,
|
bp->b_bcount - bp->b_resid,
|
||||||
@ -2026,7 +2033,7 @@ retrier(fdcu)
|
|||||||
fdc_p fdc = fdc_data + fdcu;
|
fdc_p fdc = fdc_data + fdcu;
|
||||||
register struct buf *bp;
|
register struct buf *bp;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
|
|
||||||
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
||||||
goto fail;
|
goto fail;
|
||||||
@ -2070,7 +2077,7 @@ retrier(fdcu)
|
|||||||
bp->b_flags |= B_ERROR;
|
bp->b_flags |= B_ERROR;
|
||||||
bp->b_error = EIO;
|
bp->b_error = EIO;
|
||||||
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
|
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fdc->fd->device_stats,
|
devstat_end_transaction(&fdc->fd->device_stats,
|
||||||
|
@ -31,7 +31,7 @@
|
|||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
||||||
* $Id: fdc.h,v 1.11 1998/07/29 13:00:42 bde Exp $
|
* $Id: fdc.h,v 1.12 1998/12/12 08:16:01 imp Exp $
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -68,7 +68,8 @@ struct fdc_data
|
|||||||
u_int status[7]; /* copy of the registers */
|
u_int status[7]; /* copy of the registers */
|
||||||
enum fdc_type fdct; /* chip version of FDC */
|
enum fdc_type fdct; /* chip version of FDC */
|
||||||
int fdc_errs; /* number of logged errors */
|
int fdc_errs; /* number of logged errors */
|
||||||
struct buf_queue_head head; /* Head of buf chain */
|
struct buf_queue_head head;
|
||||||
|
struct buf *bp; /* active buffer */
|
||||||
};
|
};
|
||||||
|
|
||||||
/***********************************************************************\
|
/***********************************************************************\
|
||||||
|
19
sys/isa/fd.c
19
sys/isa/fd.c
@ -47,7 +47,7 @@
|
|||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
||||||
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
|
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
struct fd_formb *finfo = NULL;
|
struct fd_formb *finfo = NULL;
|
||||||
size_t fdblk;
|
size_t fdblk;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
if(!bp) {
|
if (bp == NULL) {
|
||||||
|
bp = bufq_first(&fdc->head);
|
||||||
|
if (bp != NULL) {
|
||||||
|
bufq_remove(&fdc->head, bp);
|
||||||
|
fdc->bp = bp;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (bp == NULL) {
|
||||||
/***********************************************\
|
/***********************************************\
|
||||||
* nothing left for this controller to do *
|
* nothing left for this controller to do *
|
||||||
* Force into the IDLE state, *
|
* Force into the IDLE state, *
|
||||||
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
|
|||||||
{
|
{
|
||||||
/* ALL DONE */
|
/* ALL DONE */
|
||||||
fd->skip = 0;
|
fd->skip = 0;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fd->device_stats,
|
devstat_end_transaction(&fd->device_stats,
|
||||||
bp->b_bcount - bp->b_resid,
|
bp->b_bcount - bp->b_resid,
|
||||||
@ -2026,7 +2033,7 @@ retrier(fdcu)
|
|||||||
fdc_p fdc = fdc_data + fdcu;
|
fdc_p fdc = fdc_data + fdcu;
|
||||||
register struct buf *bp;
|
register struct buf *bp;
|
||||||
|
|
||||||
bp = bufq_first(&fdc->head);
|
bp = fdc->bp;
|
||||||
|
|
||||||
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
|
||||||
goto fail;
|
goto fail;
|
||||||
@ -2070,7 +2077,7 @@ retrier(fdcu)
|
|||||||
bp->b_flags |= B_ERROR;
|
bp->b_flags |= B_ERROR;
|
||||||
bp->b_error = EIO;
|
bp->b_error = EIO;
|
||||||
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
bp->b_resid += bp->b_bcount - fdc->fd->skip;
|
||||||
bufq_remove(&fdc->head, bp);
|
fdc->bp = NULL;
|
||||||
|
|
||||||
/* Tell devstat we have finished with the transaction */
|
/* Tell devstat we have finished with the transaction */
|
||||||
devstat_end_transaction(&fdc->fd->device_stats,
|
devstat_end_transaction(&fdc->fd->device_stats,
|
||||||
|
@ -31,7 +31,7 @@
|
|||||||
* SUCH DAMAGE.
|
* SUCH DAMAGE.
|
||||||
*
|
*
|
||||||
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
|
||||||
* $Id: fdc.h,v 1.11 1998/07/29 13:00:42 bde Exp $
|
* $Id: fdc.h,v 1.12 1998/12/12 08:16:01 imp Exp $
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
@ -68,7 +68,8 @@ struct fdc_data
|
|||||||
u_int status[7]; /* copy of the registers */
|
u_int status[7]; /* copy of the registers */
|
||||||
enum fdc_type fdct; /* chip version of FDC */
|
enum fdc_type fdct; /* chip version of FDC */
|
||||||
int fdc_errs; /* number of logged errors */
|
int fdc_errs; /* number of logged errors */
|
||||||
struct buf_queue_head head; /* Head of buf chain */
|
struct buf_queue_head head;
|
||||||
|
struct buf *bp; /* active buffer */
|
||||||
};
|
};
|
||||||
|
|
||||||
/***********************************************************************\
|
/***********************************************************************\
|
||||||
|
Loading…
Reference in New Issue
Block a user