DragonFlyBSD Kernel Audit
DF-2074 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/mlx/mlx_disk.c b/sys/dev/raid/mlx/mlx_disk.c
@@ -156,9 +156,10 @@
 static int
 mlxd_strategy(struct dev_strategy_args *ap)
 {
+    cdev_t dev = ap->a_head.a_dev;
     struct bio *bio = ap->a_bio;
     struct buf *bp = bio->bio_buf;
-    struct mlxd_softc	*sc = (struct mlxd_softc *)bio->bio_driver_info;
+    struct mlxd_softc	*sc = (struct mlxd_softc *)dev->si_drv1;
 
     debug_called(1);
 
@@ -168,6 +169,14 @@
 	bp->b_flags |= B_ERROR;
 	goto bad;
     }
+    /*
+     * Publish the softc on bio_driver_info for the downstream
+     * mlx_startio/mlx_completeio/mlxd_intr consumers.  Nothing on the
+     * I/O path sets bio_driver_info (push_bio inits bio_prev/bio_buf/
+     * bio_offset/bio_done/bio_next only), so without this the downstream
+     * derefs a stale/recycled value.  Mirror amr_disk.c:amrd_strategy.
+     */
+    bio->bio_driver_info = sc;
 
     /* XXX may only be temporarily offline - sleep? */
     if (sc->mlxd_drive->ms_state == MLX_SYSD_OFFLINE) {