From d8a25fd838f7ec01af7ca1794ef707af81fdd9bf Mon Sep 17 00:00:00 2001
From: Ted Unangst <tedu@cvs.openbsd.org>
Date: Tue, 17 Feb 2015 22:35:00 +0000
Subject: the rnd event ringbuf calculations aren't correct, which may result
 in failure to fire the collection timeout. discovered by markus. the order of
 events here doesn't actually matter, so switch to a simple stack, which is
 easier to understand. ok markus

---
 sys/dev/rnd.c | 29 ++++++++---------------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/sys/dev/rnd.c b/sys/dev/rnd.c
index cd5c6991a04..d5e3b67e63e 100644
--- a/sys/dev/rnd.c
+++ b/sys/dev/rnd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rnd.c,v 1.171 2015/02/10 21:56:09 miod Exp $	*/
+/*	$OpenBSD: rnd.c,v 1.172 2015/02/17 22:34:59 tedu Exp $	*/
 
 /*
  * Copyright (c) 2011 Theo de Raadt.
@@ -227,8 +227,8 @@ struct rand_event {
 	u_int re_time;
 	u_int re_val;
 } rnd_event_space[QEVLEN];
-struct rand_event *rnd_event_head = rnd_event_space;
-struct rand_event *rnd_event_tail = rnd_event_space;
+/* index of next free slot */
+int rnd_event_idx;
 
 struct timeout rnd_timeout;
 struct rndstats rndstats;
@@ -256,38 +256,25 @@ struct filterops randomwrite_filtops =
 static __inline struct rand_event *
 rnd_get(void)
 {
-	struct rand_event *p = rnd_event_tail;
-
-	if (p == rnd_event_head)
+	if (rnd_event_idx == 0)
 		return NULL;
 
-	if (p + 1 >= &rnd_event_space[QEVLEN])
-		rnd_event_tail = rnd_event_space;
-	else
-		rnd_event_tail++;
-
-	return p;
+	return &rnd_event_space[--rnd_event_idx];
 }
 
 static __inline struct rand_event *
 rnd_put(void)
 {
-	struct rand_event *p = rnd_event_head + 1;
-
-	if (p >= &rnd_event_space[QEVLEN])
-		p = rnd_event_space;
-
-	if (p == rnd_event_tail)
+	if (rnd_event_idx == QEVLEN)
 		return NULL;
 
-	return rnd_event_head = p;
+	return &rnd_event_space[rnd_event_idx++];
 }
 
 static __inline int
 rnd_qlen(void)
 {
-	int len = rnd_event_head - rnd_event_tail;
-	return (len < 0)? -len : len;
+	return rnd_event_idx;
 }
 
 /*
-- 
cgit v1.2.3