From nobody Tue Sep 22 14:49:22 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hq3022ly7z6sKBy for ; Tue, 22 Sep 2026 14:49:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hq3021S7vz4gwr for ; Tue, 22 Sep 2026 14:49:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790088562; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZA1i51AIjv6NSjVWUSE473ZlyN0OG0Mi0AFWRTFtNgs=; b=UkK66F6JRUvMUtmh+7qaDSjm1FMGEF1gWGXkocbr8aJdbaWPoAX3m0EQFAsuDmncrUZwn3 v3VzqavNeC/sVW18Zvy2B2tBpKuPX3qspXEc8qIvCaFKQkhGwouc9TnWDgn1YcUcRTDhJv +m3MfsCyJhmT1BBHDNlnIvRLeyeq4ewvC2do7yh5H0RrWiVCF+XaI1A8aZwyKSrUwzj97J U1jdyvpBRLWB5rCRKnAO1Aja37HvG5v3Q/5lIKRJz9cJxYTsdzLE6OMEG+Hh9I3e1HhFWh tKZoFFctxcU30pijej0JuVbxRgSbOGWxluhNM9kOhMWg0atwDYw6W1fKXvrK3A== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790088562; b=OF5I/O6X36SoFfQNPVKBLRd1NFPLpsPjftkP2HJ6kW6kEEGzEbj4WSiLo2DPyiWtKsNfQK 6QzMxQKtBtSayKLK8hYcld72KUd9MkEKc9OjcsnGqPDGOZDL7+VlOiECBA4aJYzUbZlA8U n7MhcPk/vZlM8EU95tSwQtgKD8aMACR1e3KRI0IXb8a9CYvjqtabfb3k0lGXt21nMgBOjm adgty9F0F3i16nXnG7Tyj4pATBJc7Ne4lZvsyfXTCLhECfpjVesigBwzEVCyO42YUpcD3c CqTSDExWVdlaFFDm/hcIbkcwzGreYtfxN/I0W+ivJsPYaQAkIrmOR1Fsts6Cog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790088562; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZA1i51AIjv6NSjVWUSE473ZlyN0OG0Mi0AFWRTFtNgs=; b=SbnGli6UyHCtxchjbCKKzhKe7ZbmWH0j/MJX2ZySTb1L3YjLm7J5ylNd+G7p1T+SSrHuDd t41FPNrLhpdSiIESssU0rACbU/sV9lvyEVJdH/4PZNKdGOGKXRPg+ow3WEeph+vzIxxGXv mjUWTgHpXE+2USxaINvyBOm65lZM4LQSQ3hMeJjtDeOulcFjWm1XCHpP3zT7QbZmysE+ZT CMonJ6Y8LE9iWDCL9FyrMoayCYSXNC8uByK1VGEsOmcdh9PDzH6hm8sPma+QLGeCXDoHuu bHmO1qOWx0GSd9aAtj08pmpwGdYDgycVLluYMsQGXpKMi7zFsxug04vQcr+f6Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hq3020Y1Sz19JS for ; Tue, 22 Sep 2026 14:49:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 277b1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 14:49:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 65a5b32c225a - stable/14 - buf: Avoid calling bufdomain() on newly initialized bufs List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 65a5b32c225a2d6845d6f90470f9b01ba52c432a Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 14:49:22 +0000 Message-Id: <6ab29572.277b1.299b98d4@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=65a5b32c225a2d6845d6f90470f9b01ba52c432a commit 65a5b32c225a2d6845d6f90470f9b01ba52c432a Author: Mark Johnston AuthorDate: 2026-09-04 12:46:29 +0000 Commit: Mark Johnston CommitDate: 2026-09-22 13:01:16 +0000 buf: Avoid calling bufdomain() on newly initialized bufs bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at which point they haven't yet been assigned a domain. Thus, bufdomain() returns &bdomain[-1], which trips the array-bounds sanitizer. This is harmless since we don't use the result in that case, but let's avoid the invalid access to begin with. This is sufficient to let an amd64 kernel boot to a login prompt with -fsanitize=array-bounds configured. Reported by: Andrew Griffiths Reviewed by: rlibby, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59381 (cherry picked from commit e1d903bbfaf91060c43209b35b78a9992fbffe5e) --- sys/kern/vfs_bio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c index 62d70c04f6ea..ea86b8589bfa 100644 --- a/sys/kern/vfs_bio.c +++ b/sys/kern/vfs_bio.c @@ -2024,16 +2024,13 @@ bd_flushall(struct bufdomain *bd) static void bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) { - struct bufdomain *bd; - if (bp->b_qindex != QUEUE_NONE) panic("bq_insert: free buffer %p onto another queue?", bp); - bd = bufdomain(bp); if (bp->b_flags & B_AGE) { /* Place this buf directly on the real queue. */ if (bq->bq_index == QUEUE_CLEAN) - bq = bd->bd_cleanq; + bq = bufdomain(bp)->bd_cleanq; BQ_LOCK(bq); TAILQ_INSERT_HEAD(&bq->bq_queue, bp, b_freelist); } else { @@ -2053,9 +2050,12 @@ bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) BUF_UNLOCK(bp); if (bp->b_qindex == QUEUE_CLEAN) { + struct bufdomain *bd; + /* * Flush the per-cpu queue and notify any waiters. */ + bd = bufdomain(bp); if (bd->bd_wanted || (bq != bd->bd_cleanq && bq->bq_len >= bd->bd_lim)) bd_flush(bd, bq);