Date: Thu, 20 Nov 2014 19:28:42 +0000 (UTC) From: Alexander Motin <mav@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r274756 - head/sys/cam/scsi Message-ID: <201411201928.sAKJSgF2099180@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mav Date: Thu Nov 20 19:28:42 2014 New Revision: 274756 URL: https://svnweb.freebsd.org/changeset/base/274756 Log: Remove residual xpt_release_device() call left after r272406 cleanup. Excessive release here could trigger use-after-free condition and kernel panic on LUN 0 disconnect. MFC after: 1 week Modified: head/sys/cam/scsi/scsi_xpt.c Modified: head/sys/cam/scsi/scsi_xpt.c ============================================================================== --- head/sys/cam/scsi/scsi_xpt.c Thu Nov 20 18:49:11 2014 (r274755) +++ head/sys/cam/scsi/scsi_xpt.c Thu Nov 20 19:28:42 2014 (r274756) @@ -2032,23 +2032,7 @@ scsi_scan_bus(struct cam_periph *periph, scan_info->lunindex[target_id]++; } else { mtx_unlock(&target->luns_mtx); - /* - * We're done with scanning all luns. - * - * Nuke the bogus device for lun 0 if lun 0 - * wasn't on the list. - */ - if (first != 0) { - TAILQ_FOREACH(device, - &target->ed_entries, links) { - if (device->lun_id == 0) { - break; - } - } - if (device) { - xpt_release_device(device); - } - } + /* We're done with scanning all luns. */ } } else { mtx_unlock(&target->luns_mtx);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201411201928.sAKJSgF2099180>