DragonFlyBSD Kernel Audit
DF-1912 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/md/md.c b/sys/dev/disk/md/md.c
--- a/sys/dev/disk/md/md.c
+++ b/sys/dev/disk/md/md.c
@@ -370,6 +370,11 @@
 	
 	while (1) {
 		bio = bioq_takefirst(&sc->bio_queue);
+		bp = bio->bio_buf;	/* refresh bp for THIS bio; previously
+					   assigned once before the loop and
+					   never updated, so iter 2+ used the
+					   PREVIOUS bio's (possibly freed) buf
+					   with the NEW bio's bio_offset. */
 		crit_exit();
 		if (bio == NULL)
 			break;