From owner-freebsd-usb@FreeBSD.ORG  Wed Jun 27 11:10:12 2012
Return-Path: <owner-freebsd-usb@FreeBSD.ORG>
Delivered-To: freebsd-usb@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 63D101065740
	for <freebsd-usb@hub.freebsd.org>; Wed, 27 Jun 2012 11:10:12 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 4EB658FC14
	for <freebsd-usb@hub.freebsd.org>; Wed, 27 Jun 2012 11:10:12 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q5RBACI1098034
	for <freebsd-usb@freefall.freebsd.org>; Wed, 27 Jun 2012 11:10:12 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q5RBACqn098033;
	Wed, 27 Jun 2012 11:10:12 GMT (envelope-from gnats)
Date: Wed, 27 Jun 2012 11:10:12 GMT
Message-Id: <201206271110.q5RBACqn098033@freefall.freebsd.org>
To: freebsd-usb@FreeBSD.org
From: dfilter@FreeBSD.ORG (dfilter service)
Cc: 
Subject: Re: usb/168743: commit references a PR
X-BeenThere: freebsd-usb@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: dfilter service <dfilter@FreeBSD.ORG>
List-Id: FreeBSD support for USB <freebsd-usb.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-usb>
List-Post: <mailto:freebsd-usb@freebsd.org>
List-Help: <mailto:freebsd-usb-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Jun 2012 11:10:12 -0000

The following reply was made to PR usb/168743; it has been noted by GNATS.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: usb/168743: commit references a PR
Date: Wed, 27 Jun 2012 11:04:18 +0000 (UTC)

 Author: mav
 Date: Wed Jun 27 11:04:04 2012
 New Revision: 237638
 URL: http://svn.freebsd.org/changeset/base/237638
 
 Log:
   MFC r237398:
   In camisr() clear CAM_SIM_ON_DONEQ flag after camisr_runqueue() purged SIM
   done queue. Clearing it before caused extra SIM queueing in some cases.
   It was invisible during normal operation, but during USB device unplug and
   respective SIM destruction it could keep pointer on SIM without having
   counted reference and as result crash the system by use afer free.
   
   PR:             usb/168743
 
 Modified:
   stable/8/sys/cam/cam_xpt.c
 Directory Properties:
   stable/8/sys/   (props changed)
 
 Modified: stable/8/sys/cam/cam_xpt.c
 ==============================================================================
 --- stable/8/sys/cam/cam_xpt.c	Wed Jun 27 11:02:35 2012	(r237637)
 +++ stable/8/sys/cam/cam_xpt.c	Wed Jun 27 11:04:04 2012	(r237638)
 @@ -4944,8 +4944,8 @@ camisr(void *dummy)
  		while ((sim = TAILQ_FIRST(&queue)) != NULL) {
  			TAILQ_REMOVE(&queue, sim, links);
  			CAM_SIM_LOCK(sim);
 -			sim->flags &= ~CAM_SIM_ON_DONEQ;
  			camisr_runqueue(&sim->sim_doneq);
 +			sim->flags &= ~CAM_SIM_ON_DONEQ;
  			CAM_SIM_UNLOCK(sim);
  		}
  		mtx_lock(&cam_simq_lock);
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"