misc/93998: panic in libstand when closing raw disk device

[Neel Natu]

>Number:         93998
>Category:       misc
>Synopsis:       panic in libstand when closing raw disk device
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Mar 01 22:20:03 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Neel Natu
>Release:        6.0-RELEASE
>Organization:
>Environment:
FreeBSD neel3.silverspringnet.com. 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov  3 09:36:13 UTC 2005     root at x64.samsco.home:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
We have a modified loader(8) than opens a raw disk partition using libstand open(), reads stuff from it and does a close() on the file descriptor. This close() panics because it tries to free 'f_rabuf'. This is because it has not been initialized in open() for raw disk devices.
>How-To-Repeat:
Not sure how to exercise this from the vanilla loader.
>Fix:
===================================================================
RCS file: /cvsroot/eng/gw/lib/libstand/open.c,v
retrieving revision 1.1.1.1.16.1
retrieving revision 1.2.14.1
diff -u -r1.1.1.1.16.1 -r1.2.14.1
--- open.c	16 Feb 2006 01:44:27 -0000	1.1.1.1.16.1
+++ open.c	18 Feb 2006 06:47:00 -0000	1.2.14.1
@@ -117,6 +117,7 @@
     /* see if we opened a raw device; otherwise, 'file' is the file name. */
     if (file == (char *)0 || *file == '\0') {
 	f->f_flags |= F_RAW;
+	f->f_rabuf = NULL;
 	return (fd);
     }
 

>Release-Note:
>Audit-Trail:
>Unformatted: