Author: cperciva
Date: Wed Jun 24 05:28:09 2009
New Revision: 194808
URL: http://svn.freebsd.org/changeset/base/194808
Log:
MFS r192477: Fix packet length calculation in bce(4). [EN-09:02]
MFS r191867: Correctly set IP packet length for TSO in fxp(4). [EN-09:03]
MFS r191767: Fix a lock order reversal bug that could cause deadlock during
fork(2). [EN-09:04]
Submitted by: re (kensmith)
Approved by: so (cperciva)
Errata: FreeBSD-SA-09:02.bce
Errata: FreeBSD-SA-09:03.fxp
Errata: FreeBSD-SA-09:04.fork
Modified:
releng/7.2/UPDATING
releng/7.2/lib/libc/stdlib/malloc.c
releng/7.2/sys/conf/newvers.sh
releng/7.2/sys/dev/bce/if_bce.c
releng/7.2/sys/dev/fxp/if_fxp.c
Modified: releng/7.2/UPDATING
==============================================================================
--- releng/7.2/UPDATING Wed Jun 24 04:56:13 2009 (r194807)
+++ releng/7.2/UPDATING Wed Jun 24 05:28:09 2009 (r194808)
@@ -8,6 +8,15 @@ Items affecting the ports and packages s
/usr/ports/UPDATING. Please read that file before running
portupgrade.
+20090624: p2 FreeBSD-EN-09:02.bce, FreeBSD-EN-09:03.fxp,
+ FreeBSD-EN-09:04.fork
+ Fix packet length calculation in bce(4). [EN-09:02]
+
+ Correctly set IP packet length for TSO in fxp(4). [EN-09:03]
+
+ Fix a lock order reversal bug that could cause deadlock during
+ fork(2). [EN-09:04]
+
20090610: p1 FreeBSD-SA-09:09.pipe, FreeBSD-SA-09:10.ipv6,
FreeBSD-SA-09:11.ntpd
Prevent integer overflow in direct pipe write code from circumventing
Modified: releng/7.2/lib/libc/stdlib/malloc.c
==============================================================================
--- releng/7.2/lib/libc/stdlib/malloc.c Wed Jun 24 04:56:13 2009
(r194807)
+++ releng/7.2/lib/libc/stdlib/malloc.c Wed Jun 24 05:28:09 2009
(r194808)
@@ -4715,16 +4715,41 @@ _malloc_thread_cleanup(void)
void
_malloc_prefork(void)
{
- unsigned i;
+ bool again;
+ unsigned i, j;
+ arena_t *larenas[narenas], *tarenas[narenas];
/* Acquire all mutexes in a safe order. */
- malloc_spin_lock(&arenas_lock);
- for (i = 0; i < narenas; i++) {
- if (arenas[i] != NULL)
- malloc_spin_lock(&arenas[i]->lock);
- }
- malloc_spin_unlock(&arenas_lock);
+ /*
+ * arenas_lock must be acquired after all of the arena mutexes, in
+ * order to avoid potential deadlock with arena_lock_balance[_hard]().
+ * Since arenas_lock protects the arenas array, the following code has
+ * to race with arenas_extend() callers until it succeeds in locking
+ * all arenas before locking arenas_lock.
+ */
+ memset(larenas, 0, sizeof(arena_t *) * narenas);
+ do {
+ again = false;
+
+ malloc_spin_lock(&arenas_lock);
+ for (i = 0; i < narenas; i++) {
+ if (arenas[i] != larenas[i]) {
+ memcpy(tarenas, arenas, sizeof(arena_t *) *
+ narenas);
+ malloc_spin_unlock(&arenas_lock);
+ for (j = 0; j < narenas; j++) {
+ if (larenas[j] != tarenas[j]) {
+ larenas[j] = tarenas[j];
+ malloc_spin_lock(
+ &larenas[j]->lock);
+ }
+ }
+ again = true;
+ break;
+ }
+ }
+ } while (again);
malloc_mutex_lock(&base_mtx);
@@ -4739,6 +4764,7 @@ void
_malloc_postfork(void)
{
unsigned i;
+ arena_t *larenas[narenas];
/* Release all mutexes, now that fork() has completed. */
@@ -4750,12 +4776,12 @@ _malloc_postfork(void)
malloc_mutex_unlock(&base_mtx);
- malloc_spin_lock(&arenas_lock);
+ memcpy(larenas, arenas, sizeof(arena_t *) * narenas);
+ malloc_spin_unlock(&arenas_lock);
for (i = 0; i < narenas; i++) {
- if (arenas[i] != NULL)
- malloc_spin_unlock(&arenas[i]->lock);
+ if (larenas[i] != NULL)
+ malloc_spin_unlock(&larenas[i]->lock);
}
- malloc_spin_unlock(&arenas_lock);
}
/*
Modified: releng/7.2/sys/conf/newvers.sh
==============================================================================
--- releng/7.2/sys/conf/newvers.sh Wed Jun 24 04:56:13 2009
(r194807)
+++ releng/7.2/sys/conf/newvers.sh Wed Jun 24 05:28:09 2009
(r194808)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="7.2"
-BRANCH="RELEASE-p1"
+BRANCH="RELEASE-p2"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
Modified: releng/7.2/sys/dev/bce/if_bce.c
==============================================================================
--- releng/7.2/sys/dev/bce/if_bce.c Wed Jun 24 04:56:13 2009
(r194807)
+++ releng/7.2/sys/dev/bce/if_bce.c Wed Jun 24 05:28:09 2009
(r194808)
@@ -5895,6 +5895,9 @@ bce_rx_intr(struct bce_softc *sc)
/* Set the total packet length. */
m0->m_pkthdr.len = m0->m_len = pkt_len;
}
+#else
+ /* Set the total packet length. */
+ m0->m_pkthdr.len = m0->m_len = pkt_len;
#endif
/* Remove the trailing Ethernet FCS. */
Modified: releng/7.2/sys/dev/fxp/if_fxp.c
==============================================================================
--- releng/7.2/sys/dev/fxp/if_fxp.c Wed Jun 24 04:56:13 2009
(r194807)
+++ releng/7.2/sys/dev/fxp/if_fxp.c Wed Jun 24 05:28:09 2009
(r194808)
@@ -1486,7 +1486,8 @@ fxp_encap(struct fxp_softc *sc, struct m
* checksum in the first frame driver should compute it.
*/
ip->ip_sum = 0;
- ip->ip_len = htons(ifp->if_mtu);
+ ip->ip_len = htons(m->m_pkthdr.tso_segsz + (ip->ip_hl << 2) +
+ (tcp->th_off << 2));
tcp->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
htons(IPPROTO_TCP + (tcp->th_off << 2) +
m->m_pkthdr.tso_segsz));
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
