Author: markj
Date: Wed Sep 21 00:08:42 2016
New Revision: 306061
URL: https://svnweb.freebsd.org/changeset/base/306061

Log:
  Protect ccbq access with devq->send_mtx in the XPT_ABORT handler.
  
  Submitted by: Ryan Libby <rli...@gmail.com>
  Reviewed by:  mav
  MFC after:    2 weeks
  Sponsored by: Dell EMC Isilon
  Differential Revision:        https://reviews.freebsd.org/D7985

Modified:
  head/sys/cam/cam_xpt.c

Modified: head/sys/cam/cam_xpt.c
==============================================================================
--- head/sys/cam/cam_xpt.c      Wed Sep 21 00:06:49 2016        (r306060)
+++ head/sys/cam/cam_xpt.c      Wed Sep 21 00:08:42 2016        (r306061)
@@ -2578,21 +2578,25 @@ xpt_action_default(union ccb *start_ccb)
 
                abort_ccb = start_ccb->cab.abort_ccb;
                if (XPT_FC_IS_DEV_QUEUED(abort_ccb)) {
+                       struct cam_ed *device;
+                       struct cam_devq *devq;
+
+                       device = abort_ccb->ccb_h.path->device;
+                       devq = device->sim->devq;
 
-                       if (abort_ccb->ccb_h.pinfo.index >= 0) {
-                               struct cam_ccbq *ccbq;
-                               struct cam_ed *device;
-
-                               device = abort_ccb->ccb_h.path->device;
-                               ccbq = &device->ccbq;
-                               cam_ccbq_remove_ccb(ccbq, abort_ccb);
+                       mtx_lock(&devq->send_mtx);
+                       if (abort_ccb->ccb_h.pinfo.index > 0) {
+                               cam_ccbq_remove_ccb(&device->ccbq, abort_ccb);
                                abort_ccb->ccb_h.status =
                                    CAM_REQ_ABORTED|CAM_DEV_QFRZN;
-                               xpt_freeze_devq(abort_ccb->ccb_h.path, 1);
+                               xpt_freeze_devq_device(device, 1);
+                               mtx_unlock(&devq->send_mtx);
                                xpt_done(abort_ccb);
                                start_ccb->ccb_h.status = CAM_REQ_CMP;
                                break;
                        }
+                       mtx_unlock(&devq->send_mtx);
+
                        if (abort_ccb->ccb_h.pinfo.index == CAM_UNQUEUED_INDEX
                         && (abort_ccb->ccb_h.status & CAM_SIM_QUEUED) == 0) {
                                /*
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to