CVS commit: [netbsd-9] src/sys/kern

["Martin Husemann" <martin%netbsd.org@localhost>]

Module Name:    src
Committed By:   martin
Date:           Tue Aug  1 14:54:58 UTC 2023

Modified Files:
        src/sys/kern [netbsd-9]: subr_autoconf.c

Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1688):

        sys/kern/subr_autoconf.c: revision 1.308

autoconf(9): Avoid potential ABA bug in config_makeroom.

When we unlock alldevs_lock to allocate a new cd_devs array nsp,
other threads may have:
1. freed the old one (osp),
2. done some other memory allocation,
3. allocated a new _larger_ array whose address happens to concide
   with osp (e.g., in (2) the page was recycled for a different pool
   cache), and
4. updated cd_devs back to osp but increased cd_ndevs.

In that case, the memory may be corrupted: we try to copy the wrong
number of device_t pointers into nsp and we free osp with the wrong
(stale) length.

Avoid this by checking whether cd_ndevs has changed too -- if not,
osp might have been recycled but at least the lengths we're about to
copy and free are still correct so there's no harm in an ABA
situation.


To generate a diff of this commit:
cvs rdiff -u -r1.265 -r1.265.4.1 src/sys/kern/subr_autoconf.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.