Author: ken
Date: Thu Jul 16 20:43:28 2020
New Revision: 363260
URL: https://svnweb.freebsd.org/changeset/base/363260
Log:
Hold the mutex when releasing a callout.
In xpt_release_device(), callout_stop() was being called without
holding the mutex (send_mtx) that is used to protect the callout.
So, move the mtx_unlock() call so that it is protected.
MFC after: 1 week
Sponsored by: Spectra Logic
Modified:
head/sys/cam/cam_xpt.c
Modified: head/sys/cam/cam_xpt.c
==============================================================================
--- head/sys/cam/cam_xpt.c Thu Jul 16 20:36:22 2020 (r363259)
+++ head/sys/cam/cam_xpt.c Thu Jul 16 20:43:28 2020 (r363260)
@@ -4959,15 +4959,17 @@ xpt_release_device(struct cam_ed *device)
devq = bus->sim->devq;
mtx_lock(&devq->send_mtx);
cam_devq_resize(devq, devq->send_queue.array_size - 1);
- mtx_unlock(&devq->send_mtx);
KASSERT(SLIST_EMPTY(&device->periphs),
("destroying device, but periphs list is not empty"));
KASSERT(device->devq_entry.index == CAM_UNQUEUED_INDEX,
("destroying device while still queued for ccbs"));
+ /* The send_mtx must be held when accessing the callout */
if ((device->flags & CAM_DEV_REL_TIMEOUT_PENDING) != 0)
callout_stop(&device->callout);
+
+ mtx_unlock(&devq->send_mtx);
xpt_release_target(device->target);
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
