EtNbZ07IqEtSkhryuqH8nrjMa6So6GDgm8wDdjJDoPqIdnsg Ddt1r6EGmoripQ/WL7PIn0WEFsfJR7bYM9qffYPK92Ef3MIsD2FaUJHCs+/Plg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786329086; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=l/Lot40Uhc2eASqRf7OkOMHg1htdY07Tt+Z4Q8vYMH0=; b=ctMWozrIGy6xF9Emkb8X2bFdGHvNp+4NAstc61CsiG1oZE1EeiK+k5cQxMIdM3CjIgpyN/ dUEjJbOjYT/14TuNxlrmdQNFGDLLc5ygY8vQqAAbtNM/TLqfZKJxeIAMCicHO2Al76lpQY /GoWkESEKJg9LIQY/51WCTzg5UyVFtPH9CEB4DFgC7Q6BQawV4eCfyT4gBeuju8/OeFnrL nQLFBQMGNaaxl1ID6ekDX+WAklkec5G3YLk9oOKrw2CpE2gQNNNRjKkJ45YX3O4MyJfsK5 6qa6lF3/VkRpwdtezpfktvq/d5XJ6B+bTy8b9BNxpjV41BfgOpoWq3IDVjc/Wg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hJJfP6ykFzqlC for ; Mon, 10 Aug 2026 02:31:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f865 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 10 Aug 2026 02:31:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jaeyoon Choi Subject: git: c71705a08304 - main - ufshci: do not free the devq twice on SIM attach failure List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c71705a0830497c080579896b4aa2a5ce2513f1c Auto-Submitted: auto-generated Date: Mon, 10 Aug 2026 02:31:25 +0000 Message-Id: <6a7937fd.1f865.199d4809@gitrepo.freebsd.org> The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=c71705a0830497c080579896b4aa2a5ce2513f1c commit c71705a0830497c080579896b4aa2a5ce2513f1c Author: Jaeyoon Choi AuthorDate: 2026-08-10 01:44:35 +0000 Commit: Jaeyoon Choi CommitDate: 2026-08-10 02:28:51 +0000 ufshci: do not free the devq twice on SIM attach failure cam_sim_free() with free_devq set already frees the devq, so the following cam_simq_free() call on the xpt_bus_register() and xpt_create_path() failure paths was a double free. Also clear ctrlr->ufshci_sim so a later ufshci_sim_detach() does not operate on the freed SIM. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58662 --- sys/dev/ufshci/ufshci_sim.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/dev/ufshci/ufshci_sim.c b/sys/dev/ufshci/ufshci_sim.c index 9d80dd195ad9..4a106a6c7b8a 100644 --- a/sys/dev/ufshci/ufshci_sim.c +++ b/sys/dev/ufshci/ufshci_sim.c @@ -371,8 +371,9 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr) mtx_lock(&ctrlr->sc_mtx); if (xpt_bus_register(ctrlr->ufshci_sim, ctrlr->dev, 0) != CAM_SUCCESS) { + /* cam_sim_free() with free_devq also frees the devq. */ cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE); - cam_simq_free(devq); + ctrlr->ufshci_sim = NULL; mtx_unlock(&ctrlr->sc_mtx); printf("Failed to create a bus\n"); return (ENOMEM); @@ -383,7 +384,7 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr) CAM_LUN_WILDCARD) != CAM_REQ_CMP) { xpt_bus_deregister(cam_sim_path(ctrlr->ufshci_sim)); cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE); - cam_simq_free(devq); + ctrlr->ufshci_sim = NULL; mtx_unlock(&ctrlr->sc_mtx); printf("Failed to create a path\n"); return (ENOMEM);