kern/81450: ATAPI support broken in -STABLE

Sean McNeil sean at
Tue May 24 20:40:02 GMT 2005

>Number:         81450
>Category:       kern
>Synopsis:       ATAPI support broken in -STABLE
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue May 24 20:40:01 GMT 2005
>Originator:     Sean McNeil
>Release:        5.4-STABLE
Sean McNeil Consulting, Inc
FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #25: Sun May 22 15:35:15 PDT 2005     root at  amd64

      ata-queue.c:ata_completed() will issue a sense request when it encounters an ATAPI error.  This request fails to zero out the donecount which causes corruption of memory.  On amd64, it overwrites the callback value and crashes the computer.
      Try to burn a CD from nautilus.  Since nautilus just invokes cdrecord, it should cause the same result by running cdrecord from a command line.

      The following patch fixes the crash:

--- sys/dev/ata/ata-queue.c.orig        Sun May 22 15:28:03 2005
+++ sys/dev/ata/ata-queue.c     Sun May 22 15:28:27 2005
@@ -340,6 +340,7 @@
            request->data = (caddr_t)&request->u.atapi.sense_data;
            request->bytecount = sizeof(struct atapi_sense);
            request->transfersize = sizeof(struct atapi_sense);
+           request->donecount = 0;
            request->timeout = 5;
            request->flags &= (ATA_R_ATAPI | ATA_R_QUIET);
            request->flags |= (ATA_R_READ | ATA_R_IMMEDIATE | ATA_R_REQUEUE);


More information about the freebsd-bugs mailing list