From 68355d6522b92faa2a6fc1815d6ddba4231b59ee Mon Sep 17 00:00:00 2001 From: Alexander Motin Date: Thu, 20 Nov 2014 19:28:42 +0000 Subject: [PATCH] Remove residual xpt_release_device() call left after r272406 cleanup. Excessive release here could trigger use-after-free condition and kernel panic on LUN 0 disconnect. MFC after: 1 week --- sys/cam/scsi/scsi_xpt.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/sys/cam/scsi/scsi_xpt.c b/sys/cam/scsi/scsi_xpt.c index 5677cdde125f..3c087455bce3 100644 --- a/sys/cam/scsi/scsi_xpt.c +++ b/sys/cam/scsi/scsi_xpt.c @@ -2032,23 +2032,7 @@ scsi_scan_bus(struct cam_periph *periph, union ccb *request_ccb) scan_info->lunindex[target_id]++; } else { mtx_unlock(&target->luns_mtx); - /* - * We're done with scanning all luns. - * - * Nuke the bogus device for lun 0 if lun 0 - * wasn't on the list. - */ - if (first != 0) { - TAILQ_FOREACH(device, - &target->ed_entries, links) { - if (device->lun_id == 0) { - break; - } - } - if (device) { - xpt_release_device(device); - } - } + /* We're done with scanning all luns. */ } } else { mtx_unlock(&target->luns_mtx);