The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e1d903bbfaf91060c43209b35b78a9992fbffe5e
commit e1d903bbfaf91060c43209b35b78a9992fbffe5e Author: Mark Johnston <[email protected]> AuthorDate: 2026-09-04 12:46:29 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-09-04 12:46:44 +0000 buf: Avoid calling bufdomain() on newly initialized bufs bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at which point they haven't yet been assigned a domain. Thus, bufdomain() returns &bdomain[-1], which trips the array-bounds sanitizer. This is harmless since we don't use the result in that case, but let's avoid the invalid access to begin with. This is sufficient to let an amd64 kernel boot to a login prompt with -fsanitize=array-bounds configured. Reported by: Andrew Griffiths <[email protected]> Reviewed by: rlibby, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59381 --- sys/kern/vfs_bio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c index cb45ca7c75b7..868d7de7d6c8 100644 --- a/sys/kern/vfs_bio.c +++ b/sys/kern/vfs_bio.c @@ -2032,16 +2032,13 @@ bd_flushall(struct bufdomain *bd) static void bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) { - struct bufdomain *bd; - if (bp->b_qindex != QUEUE_NONE) panic("bq_insert: free buffer %p onto another queue?", bp); - bd = bufdomain(bp); if (bp->b_flags & B_AGE) { /* Place this buf directly on the real queue. */ if (bq->bq_index == QUEUE_CLEAN) - bq = bd->bd_cleanq; + bq = bufdomain(bp)->bd_cleanq; BQ_LOCK(bq); TAILQ_INSERT_HEAD(&bq->bq_queue, bp, b_freelist); } else { @@ -2054,12 +2051,15 @@ bq_insert(struct bufqueue *bq, struct buf *bp, bool unlock) bp->b_subqueue = bq->bq_subqueue; if (bp->b_qindex == QUEUE_CLEAN) { + struct bufdomain *bd; + /* * Flush the per-cpu queue and notify any waiters. * * Unlock before we notify so that we don't wakeup a waiter * that fails a trylock on the buf and sleeps again. */ + bd = bufdomain(bp); if (bd->bd_wanted || (bq != bd->bd_cleanq && bq->bq_len >= bd->bd_lim)) { if (unlock) {
