Hold the mutex when releasing a callout.
In xpt_release_device(), callout_stop() was being called without holding the mutex (send_mtx) that is used to protect the callout. So, move the mtx_unlock() call so that it is protected. MFC after: 1 week Sponsored by: Spectra Logic
This commit is contained in:
parent
f903a308a1
commit
03caca368a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=363260
@ -4959,16 +4959,18 @@ xpt_release_device(struct cam_ed *device)
|
|||||||
devq = bus->sim->devq;
|
devq = bus->sim->devq;
|
||||||
mtx_lock(&devq->send_mtx);
|
mtx_lock(&devq->send_mtx);
|
||||||
cam_devq_resize(devq, devq->send_queue.array_size - 1);
|
cam_devq_resize(devq, devq->send_queue.array_size - 1);
|
||||||
mtx_unlock(&devq->send_mtx);
|
|
||||||
|
|
||||||
KASSERT(SLIST_EMPTY(&device->periphs),
|
KASSERT(SLIST_EMPTY(&device->periphs),
|
||||||
("destroying device, but periphs list is not empty"));
|
("destroying device, but periphs list is not empty"));
|
||||||
KASSERT(device->devq_entry.index == CAM_UNQUEUED_INDEX,
|
KASSERT(device->devq_entry.index == CAM_UNQUEUED_INDEX,
|
||||||
("destroying device while still queued for ccbs"));
|
("destroying device while still queued for ccbs"));
|
||||||
|
|
||||||
|
/* The send_mtx must be held when accessing the callout */
|
||||||
if ((device->flags & CAM_DEV_REL_TIMEOUT_PENDING) != 0)
|
if ((device->flags & CAM_DEV_REL_TIMEOUT_PENDING) != 0)
|
||||||
callout_stop(&device->callout);
|
callout_stop(&device->callout);
|
||||||
|
|
||||||
|
mtx_unlock(&devq->send_mtx);
|
||||||
|
|
||||||
xpt_release_target(device->target);
|
xpt_release_target(device->target);
|
||||||
|
|
||||||
cam_ccbq_fini(&device->ccbq);
|
cam_ccbq_fini(&device->ccbq);
|
||||||
|
Loading…
Reference in New Issue
Block a user