DF-1912 / fix.diff
diff --git a/sys/dev/disk/md/md.c b/sys/dev/disk/md/md.c --- a/sys/dev/disk/md/md.c +++ b/sys/dev/disk/md/md.c @@ -370,6 +370,11 @@ while (1) { bio = bioq_takefirst(&sc->bio_queue); + bp = bio->bio_buf; /* refresh bp for THIS bio; previously + assigned once before the loop and + never updated, so iter 2+ used the + PREVIOUS bio's (possibly freed) buf + with the NEW bio's bio_offset. */ crit_exit(); if (bio == NULL) break; |