From owner-freebsd-drivers@freebsd.org  Sun Jun 18 03:19:44 2017
Return-Path: <owner-freebsd-drivers@freebsd.org>
Delivered-To: freebsd-drivers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 39F0ED87607
 for <freebsd-drivers@mailman.ysv.freebsd.org>;
 Sun, 18 Jun 2017 03:19:44 +0000 (UTC)
 (envelope-from baijiaju1990@163.com)
Received: from m12-13.163.com (m12-13.163.com [220.181.12.13])
 by mx1.freebsd.org (Postfix) with ESMTP id 7EEBE81566
 for <freebsd-drivers@freebsd.org>; Sun, 18 Jun 2017 03:19:42 +0000 (UTC)
 (envelope-from baijiaju1990@163.com)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;
 s=s110527; h=From:Subject:Message-ID:Date:MIME-Version; bh=SukhG
 lC1Its8c3ZOiS3OldqcGheqHf+HZc3vJMk5uXI=; b=jNm7U3Mwinrvs6EsYHmcB
 xZMdLsyv/NP9i+jyubI3mjDYqQseVeQtZN4U5LwLKciQuvL1RgYuPgc5SA4yY87e
 URYUl9bKbhSMSfNPAuiDc9nSigmQcEfo1+0hm0SNpuSK3fw1O7ndfhGCj31LHZUW
 hHb942dn60Pyhw6quntEQc=
Received: from [166.111.70.13] (unknown [166.111.70.13])
 by smtp9 (Coremail) with SMTP id DcCowADX3EhH8UVZhP7FLA--.55429S2;
 Sun, 18 Jun 2017 11:19:35 +0800 (CST)
To: freebsd-drivers@freebsd.org
From: Jia-Ju Bai <baijiaju1990@163.com>
Subject: [Bug 220094] [scsi] sys/cam/scsi/scsi_sa.c: a sleep-under-mutex bug
 in saioctl
Message-ID: <8e0674f6-8df7-7650-4576-fad0b2f48d10@163.com>
Date: Sun, 18 Jun 2017 11:19:35 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
X-CM-TRANSID: DcCowADX3EhH8UVZhP7FLA--.55429S2
X-Coremail-Antispam: 1Uf129KBjDUn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7v73
 VFW2AGmfu7bjvjm3AaLaJ3UbIYCTnIWIevJa73UjIFyTuYvjxUgPkuUUUUU
X-Originating-IP: [166.111.70.13]
X-CM-SenderInfo: xedlyx5dmximizq6il2tof0z/1tbiGAf6elXlaIMAGgAAse
X-BeenThere: freebsd-drivers@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Writing device drivers for FreeBSD <freebsd-drivers.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-drivers>, 
 <mailto:freebsd-drivers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-drivers/>
List-Post: <mailto:freebsd-drivers@freebsd.org>
List-Help: <mailto:freebsd-drivers-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-drivers>, 
 <mailto:freebsd-drivers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 18 Jun 2017 03:19:44 -0000

The driver may sleep under a mutex, and the function call path in file 
"sys/cam/scsi/scsi_sa.c" in FreeBSD 11.0 is:
saioctl [line 1680: acquire the mutex]
   saextget [line 1683]
     malloc(M_WAITOK) [line 4444] --> may sleep

The possible fix of this bug is to replace "M_WAITOK" in malloc with 
"M_NOWAIT".

This bug is found by a static analysis tool written by myself, and it is 
checked by my review of the FreeBSD code.

Thanks,
Jia-Ju Bai