d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In camisr() clear CAM_SIM_ON_DONEQ flag after camisr_runqueue() purged SIM

Browse Source 
done queue. Clearing it before caused extra SIM queueing in some cases.
It was invisible during normal operation, but during USB device unplug and
respective SIM destruction it could keep pointer on SIM without having
counted reference and as result crash the system by use afer free.

Reported by:	hselasky
MFC after:	1 week
This commit is contained in:
Alexander Motin 2012-06-21 14:35:46 +00:00
parent db356f0370
commit 10284c8b26
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=237398
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/cam/cam_xpt.c
View File

@ -5005,8 +5005,8 @@ camisr(void *dummy)
while ((sim = TAILQ_FIRST(&queue)) != NULL) {
TAILQ_REMOVE(&queue, sim, links);
CAM_SIM_LOCK(sim);
sim->flags &= ~CAM_SIM_ON_DONEQ;
camisr_runqueue(&sim->sim_doneq);
sim->flags &= ~CAM_SIM_ON_DONEQ;
CAM_SIM_UNLOCK(sim);
}
mtx_lock(&cam_simq_lock);