From nobody Tue Sep 22 17:08:08 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hq64826QDz6slpw for ; Tue, 22 Sep 2026 17:08:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hq6481dDdz3Gj0 for ; Tue, 22 Sep 2026 17:08:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kh5pqRsQuj8ThZzogPr2PPDxATTU94s8ILJQ49Lit18=; b=hw23L8rWLmRg6SkkCua8xD7ywmJsrFO/avBwJCxn750KuFTl7qRIC/VhS851R6UF4hlWpP sAEqr5P3KoHXSmYjzIyNv6xpHt/qN1J/JA+lo6jN9heUV0TbWk6t9GOdQFG1zYD8mDWmoT 34fVUFwB3miJi7O5RTnXK6lG/PGAQSemViXdMB33LnAKjLxZHiR38gBUVDFy0HIYH+EgLW GWIW59Cm4jzmtJDRrwcD66jMdGtt3YRB/CYjBGQD7WK36POQ9j85MoHwr3RdBW5I7psM/i n02Zqw+9sJc95DT+DiTfJw6pMXjS0fK9UXLyqH/ZmILEoZeww6axrYPKDofPAg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790096888; b=FT/5/QHjGnVCc18+GP+mQplOrp8f71ogPhXY5NAuGp65OWq+3PcvDBuMGsN8/18nPtDkPs u84QxAPXMDMf3jAbK99yPYIdED0z7/tcSixykb5WCimMlBc544Y3E3c02E0IRVjw6JxPu6 FAJS20LYO9LmS9IrB06IWdD82zdLoFz2No/h3A7g5EYAeQYTlV/HuDEcOyMQ0wbI8kVfy5 LUmnIb1hDpNh+EIO9PxAe63S2jvWIjCFRK8u7IGNqznaeQt4m99pp/D4SsAYm4glr8JTKW 2KzITB1uXHAHLqwlxxDA+pGsvkuRZpxL7wH9nEr3lzXfDgGrUhg2Sz9xV/CmSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Kh5pqRsQuj8ThZzogPr2PPDxATTU94s8ILJQ49Lit18=; b=aO6bHFpFzXSGp3EjTm0MliItNgd9qv6R3916rss6UvLPrsEkkTkhhxUy3UFZNjL/lA8Xb0 6N/lfPkBo8yUdxIs0Uyllhep4bQwCVhWRZkBaC5uZmIsuRwU0/UHYxHpJn5YkzTSZwxKDB ywrz3COdQSQzRO1NRh4Q6+gmm4VvuHZbeAgtmXQd0J7rX/vjuCZguNo9pbY8jaLRerGwwh uTLIZSxvDy9FAeWHZj2SbWW3WncQedas/oIJ7bcFetJ9ys6G5PoPZLm0MHIm7MAUXTOxPe RytwWdLp/EqxAMY+3mmpoD8vRj+GhZrhab/LcUzK+zGknMNd4hL+LWFi9ip24Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hq6480hQZzG6Y for ; Tue, 22 Sep 2026 17:08:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3dfa2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 17:08:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: cea39b960f9d - stable/15 - buf: Avoid calling bufdomain() on newly initialized bufs List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: cea39b960f9dac460200c9cf43ae407cec814f8b Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 17:08:08 +0000 Message-Id: <6ab2b5f8.3dfa2.720cbaa4@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=cea39b960f9dac460200c9cf43ae407cec814f8b commit cea39b960f9dac460200c9cf43ae407cec814f8b Author: Mark Johnston AuthorDate: 2026-09-04 12:46:29 +0000 Commit: Mark Johnston CommitDate: 2026-09-22 17:06:52 +0000 buf: Avoid calling bufdomain() on newly initialized bufs bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at which point they haven't yet been assigned a domain. Thus, bufdomain() returns &bdomain[-1], which trips the array-bounds sanitizer. This is harmless since we don't use the result in that case, but let's avoid the invalid access to begin with. This is sufficient to let an amd64 kernel boot to a login prompt with -fsanitize=array-bounds configured. Reported by: Andrew Griffiths Reviewed by: rlibby, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59381 (cherry picked from commit e1d903bbfaf91060c43209b35b78a9992fbffe5e) --- sys/kern/vfs_bio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c index 5b8d4a87c1ab..509ece1727cd 100644 --- a/sys/kern/vfs_bio.c +++ b/sys/kern/vfs_bio.c @@ -2033,16 +2033,13 @@ bd_flushall(struct bufdomain *bd) static void bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) { - struct bufdomain *bd; - if (bp->b_qindex != QUEUE_NONE) panic("bq_insert: free buffer %p onto another queue?", bp); - bd = bufdomain(bp); if (bp->b_flags & B_AGE) { /* Place this buf directly on the real queue. */ if (bq->bq_index == QUEUE_CLEAN) - bq = bd->bd_cleanq; + bq = bufdomain(bp)->bd_cleanq; BQ_LOCK(bq); TAILQ_INSERT_HEAD(&bq->bq_queue, bp, b_freelist); } else { @@ -2062,9 +2059,12 @@ bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) BUF_UNLOCK(bp); if (bp->b_qindex == QUEUE_CLEAN) { + struct bufdomain *bd; + /* * Flush the per-cpu queue and notify any waiters. */ + bd = bufdomain(bp); if (bd->bd_wanted || (bq != bd->bd_cleanq && bq->bq_len >= bd->bd_lim)) bd_flush(bd, bq);