hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2025-01-11 17:04:19 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed corruption of the fd buffer queue. Once upon a time, the active

Browse Source 
buffer had to be left on the head of the queue for [bufq]disksort()
to sort against.  This isn't right for devices that can support multiple
active i/o's, and only the fd driver did it.  "Fixing" this in rev.1.36
of ufs_disksubr.c broke the fd driver in much the same way as rev.1.52
of <sys/buf.h> broke it (see rev.1.119).

Bug reported and fix tested by:	dt
This commit is contained in:
Bruce Evans 1999-01-15 09:15:27 +00:00
parent d75398b55e
commit e93e63cb39
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=42690
5 changed files with 45 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/dev/fdc/fdc.c
View File

@ -47,7 +47,7 @@
* SUCH DAMAGE.
*
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
*
*/
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
struct fd_formb *finfo = NULL;
size_t fdblk;
bp = fdc->bp;
if (bp == NULL) {
bp = bufq_first(&fdc->head);
if(!bp) {
if (bp != NULL) {
bufq_remove(&fdc->head, bp);
fdc->bp = bp;
}
}
if (bp == NULL) {
/***********************************************\
* nothing left for this controller to do *
* Force into the IDLE state, *
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
{
/* ALL DONE */
fd->skip = 0;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fd->device_stats,
bp->b_bcount - bp->b_resid,
@ -2026,7 +2033,7 @@ retrier(fdcu)
fdc_p fdc = fdc_data + fdcu;
register struct buf *bp;
bp = bufq_first(&fdc->head);
bp = fdc->bp;
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
goto fail;
@ -2070,7 +2077,7 @@ retrier(fdcu)
bp->b_flags |= B_ERROR;
bp->b_error = EIO;
bp->b_resid += bp->b_bcount - fdc->fd->skip;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fdc->fd->device_stats,

17
sys/i386/isa/fd.c
View File

@ -47,7 +47,7 @@
* SUCH DAMAGE.
*
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
*
*/
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
struct fd_formb *finfo = NULL;
size_t fdblk;
bp = fdc->bp;
if (bp == NULL) {
bp = bufq_first(&fdc->head);
if(!bp) {
if (bp != NULL) {
bufq_remove(&fdc->head, bp);
fdc->bp = bp;
}
}
if (bp == NULL) {
/***********************************************\
* nothing left for this controller to do *
* Force into the IDLE state, *
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
{
/* ALL DONE */
fd->skip = 0;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fd->device_stats,
bp->b_bcount - bp->b_resid,
@ -2026,7 +2033,7 @@ retrier(fdcu)
fdc_p fdc = fdc_data + fdcu;
register struct buf *bp;
bp = bufq_first(&fdc->head);
bp = fdc->bp;
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
goto fail;
@ -2070,7 +2077,7 @@ retrier(fdcu)
bp->b_flags |= B_ERROR;
bp->b_error = EIO;
bp->b_resid += bp->b_bcount - fdc->fd->skip;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fdc->fd->device_stats,

5
sys/i386/isa/fdc.h
View File

@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
* $Id: fdc.h,v 1.11 1998/07/29 13:00:42 bde Exp $
* $Id: fdc.h,v 1.12 1998/12/12 08:16:01 imp Exp $
*
*/
@ -68,7 +68,8 @@ struct fdc_data
u_int status[7]; /* copy of the registers */
enum fdc_type fdct; /* chip version of FDC */
int fdc_errs; /* number of logged errors */
struct buf_queue_head head; /* Head of buf chain */
struct buf_queue_head head;
struct buf *bp; /* active buffer */
};
/***********************************************************************\

17
sys/isa/fd.c
View File

@ -47,7 +47,7 @@
* SUCH DAMAGE.
*
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
* $Id: fd.c,v 1.129 1998/12/14 16:29:58 bde Exp $
* $Id: fd.c,v 1.130 1998/12/27 13:40:56 phk Exp $
*
*/
@ -1530,8 +1530,15 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
struct fd_formb *finfo = NULL;
size_t fdblk;
bp = fdc->bp;
if (bp == NULL) {
bp = bufq_first(&fdc->head);
if(!bp) {
if (bp != NULL) {
bufq_remove(&fdc->head, bp);
fdc->bp = bp;
}
}
if (bp == NULL) {
/***********************************************\
* nothing left for this controller to do *
* Force into the IDLE state, *
@ -1903,7 +1910,7 @@ fdstate(fdcu_t fdcu, fdc_p fdc)
{
/* ALL DONE */
fd->skip = 0;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fd->device_stats,
bp->b_bcount - bp->b_resid,
@ -2026,7 +2033,7 @@ retrier(fdcu)
fdc_p fdc = fdc_data + fdcu;
register struct buf *bp;
bp = bufq_first(&fdc->head);
bp = fdc->bp;
if(fd_data[FDUNIT(minor(bp->b_dev))].options & FDOPT_NORETRY)
goto fail;
@ -2070,7 +2077,7 @@ retrier(fdcu)
bp->b_flags |= B_ERROR;
bp->b_error = EIO;
bp->b_resid += bp->b_bcount - fdc->fd->skip;
bufq_remove(&fdc->head, bp);
fdc->bp = NULL;
/* Tell devstat we have finished with the transaction */
devstat_end_transaction(&fdc->fd->device_stats,

5
sys/isa/fdc.h
View File

@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* from: @(#)fd.c 7.4 (Berkeley) 5/25/91
* $Id: fdc.h,v 1.11 1998/07/29 13:00:42 bde Exp $
* $Id: fdc.h,v 1.12 1998/12/12 08:16:01 imp Exp $
*
*/
@ -68,7 +68,8 @@ struct fdc_data
u_int status[7]; /* copy of the registers */
enum fdc_type fdct; /* chip version of FDC */
int fdc_errs; /* number of logged errors */
struct buf_queue_head head; /* Head of buf chain */
struct buf_queue_head head;
struct buf *bp; /* active buffer */
};
/***********************************************************************\