From nobody Tue Sep 22 17:08:08 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hq64F3Dvlz6slq4 for ; Tue, 22 Sep 2026 17:08:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hq64F2fclz3Gp4 for ; Tue, 22 Sep 2026 17:08:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096893; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kh5pqRsQuj8ThZzogPr2PPDxATTU94s8ILJQ49Lit18=; b=pwVwt1cjEOZrGLdgHUxcG/vbU4+aSSPjoIcK6rmLbIJctE6jcl2IYeEPUMwe27oLYIYhdE 4z8wovBInzEUh8OuwMzAvbjM99fMAuzMlI7lhpreZJVnxuNco1IIHlYMkdBW2OHjBBfcTk Xf+GtM9H6VVYm5r0A4oUrbASaGaNS87fOwDjoCm+gXZ+zQrFpUeH59ruQ07i5fa4cDV8/G LYVfYGj6WpxWyacawplegR58pFljwuYjulACTnJkqvqhhveHnZ/vmXQbv5OZkTBKRDMPIf VWlLItrzhw0nNslLIGO0GHKro/7IU28NTiraQ/rR9p4dDkr+obAr+BMywbPl+w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790096893; b=qXcb6aQ59ovPcah3zVbvM+3i0GEhdnrwf4AXGEda6jXhajzvyFBv1Ya3i4OMdxKbCJdP3Y uhQLxFll2/Dj0Mult/y0u3NtRlWtDXfdWRAJfCRC2FEhAPaa2Hylaz76lZ+tlgycPsfaBL 8rTT8wKeVDc89jfYFFTTzMi2Tt145lGy/skr6tuHYMEgpUjcBGGHF+MVxBIH6dXCNonOAJ +U61yled0f/Z6ulYW4cj1+9UvvZpufDLEN2VVSL0BotmAZYZ1Ie8G5kIN7Uoe5mcp0DiAe ZvwB+0qD9K+57JKeoenuuLLMMpznMsi+/Iwccg3yNGEt6BHcNhdI7f5gjjGgFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096893; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kh5pqRsQuj8ThZzogPr2PPDxATTU94s8ILJQ49Lit18=; b=TqeeAG6+honCMG8z2yJhLLjwqbOaItNVi3ombiveHgmTgRHsgRVx73hZ93JVntIkySmBc5 NPupfA78ZQDdr7Aq721E0PtnbWUe9yPkRNqoeqVyiOPLoypDsFiPrquyv2sm+u9j3YHf+C z6H/SRdJXUJkOEeOv4c3krd6fXfWzR7zPHpbNcLeCIKJBAqiGqQHtJdFc7X5AXbZ8vkRzT 7vCgm2TNxc9Wmu31LR9cYQ0e6VOUJMDySQRswtKhoCRfLxQd5ZmOtIZ2ByqOg8BjyW572u OxYKLhyLzn8yXT1c/uf292Pq3P6I9cehGbOIaXq3p5mIp8aVeFpobTIyRpo1oA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hq64F1kPqzG6Z for ; Tue, 22 Sep 2026 17:08:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3dfa2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 17:08:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: cea39b960f9d - stable/15 - buf: Avoid calling bufdomain() on newly initialized bufs List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: cea39b960f9dac460200c9cf43ae407cec814f8b Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 17:08:08 +0000 Message-Id: <6ab2b5f8.3dfa2.720cbaa4@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=cea39b960f9dac460200c9cf43ae407cec814f8b commit cea39b960f9dac460200c9cf43ae407cec814f8b Author: Mark Johnston AuthorDate: 2026-09-04 12:46:29 +0000 Commit: Mark Johnston CommitDate: 2026-09-22 17:06:52 +0000 buf: Avoid calling bufdomain() on newly initialized bufs bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at which point they haven't yet been assigned a domain. Thus, bufdomain() returns &bdomain[-1], which trips the array-bounds sanitizer. This is harmless since we don't use the result in that case, but let's avoid the invalid access to begin with. This is sufficient to let an amd64 kernel boot to a login prompt with -fsanitize=array-bounds configured. Reported by: Andrew Griffiths Reviewed by: rlibby, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59381 (cherry picked from commit e1d903bbfaf91060c43209b35b78a9992fbffe5e) --- sys/kern/vfs_bio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c index 5b8d4a87c1ab..509ece1727cd 100644 --- a/sys/kern/vfs_bio.c +++ b/sys/kern/vfs_bio.c @@ -2033,16 +2033,13 @@ bd_flushall(struct bufdomain *bd) static void bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) { - struct bufdomain *bd; - if (bp->b_qindex != QUEUE_NONE) panic("bq_insert: free buffer %p onto another queue?", bp); - bd = bufdomain(bp); if (bp->b_flags & B_AGE) { /* Place this buf directly on the real queue. */ if (bq->bq_index == QUEUE_CLEAN) - bq = bd->bd_cleanq; + bq = bufdomain(bp)->bd_cleanq; BQ_LOCK(bq); TAILQ_INSERT_HEAD(&bq->bq_queue, bp, b_freelist); } else { @@ -2062,9 +2059,12 @@ bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) BUF_UNLOCK(bp); if (bp->b_qindex == QUEUE_CLEAN) { + struct bufdomain *bd; + /* * Flush the per-cpu queue and notify any waiters. */ + bd = bufdomain(bp); if (bd->bd_wanted || (bq != bd->bd_cleanq && bq->bq_len >= bd->bd_lim)) bd_flush(bd, bq);