svn commit: r255866 - head/sys/fs/cd9660

[John-Mark Gurney]

Author: jmg
Date: Wed Sep 25 02:48:12 2013
New Revision: 255866
URL: http://svnweb.freebsd.org/changeset/base/255866

Log:
  fix a bug where we access a bread buffer after we have brelse'd it...
  The kernel normally didn't unmap/context switch away before we accessed
  the buffer most of the time, but under heavy I/O pressure and lots of
  mount/unmounting this would cause a fault on nofault panic...
  
  Reviewed by:	dteske
  Approved by:	re (kib)
  Sponsored by:	Vicor
  MFC after:	3 days

Modified:
  head/sys/fs/cd9660/cd9660_vfsops.c

Modified: head/sys/fs/cd9660/cd9660_vfsops.c
==============================================================================
--- head/sys/fs/cd9660/cd9660_vfsops.c	Wed Sep 25 01:48:45 2013	(r255865)
+++ head/sys/fs/cd9660/cd9660_vfsops.c	Wed Sep 25 02:48:12 2013	(r255866)
@@ -390,11 +390,11 @@ iso_mountfs(devvp, mp)
 
 	/* Check the Rock Ridge Extension support */
 	if (!(isomp->im_flags & ISOFSMNT_NORRIP)) {
-		if ((error = bread(isomp->im_devvp,
-				  (isomp->root_extent + isonum_711(rootp->ext_attr_length)) <<
-				  (isomp->im_bshift - DEV_BSHIFT),
-				  isomp->logical_block_size, NOCRED, &bp)) != 0)
-		    goto out;
+		if ((error = bread(isomp->im_devvp, (isomp->root_extent +
+		    isonum_711(((struct iso_directory_record *)isomp->root)->
+		    ext_attr_length)) << (isomp->im_bshift - DEV_BSHIFT),
+		    isomp->logical_block_size, NOCRED, &bp)) != 0)
+			goto out;
 
 		rootp = (struct iso_directory_record *)bp->b_data;