D60335.diff
No OneTemporary
Actions

Size

930 B

Referenced Files

None

Subscribers

None

D60335.diff
View Options

	Index: sys/dev/mpi3mr/mpi3mr_app.c
	===================================================================
	--- sys/dev/mpi3mr/mpi3mr_app.c
	+++ sys/dev/mpi3mr/mpi3mr_app.c
	@@ -1248,8 +1248,21 @@
	sc->mpi3mr_aen_triggered = 0;

	out_failed:
	- if (tgtdev)
	- mpi3mr_atomic_dec(&tgtdev->block_io);
	+ if (tgtdev) {
	+ /*
	+ * Re-resolve the target before decrementing block_io: the raw
	+ * tgtdev pointer may point to freed memory if the device was
	+ * removed during the potentially long ioctl wait
	+ * (karg->timeout is U16, up to 65535 seconds). A fresh lookup
	+ * under target_lock is safe; if the target is gone we simply
	+ * skip the decrement.
	+ */
	+ struct mpi3mr_target *tgtdev_recheck =
	+ mpi3mr_find_target_by_dev_handle(sc->cam_sc,
	+ tm_req->DevHandle);
	+ if (tgtdev_recheck)
	+ mpi3mr_atomic_dec(&tgtdev_recheck->block_io);
	+ }

	sc->ioctl_cmds.is_senseprst = 0;
	sc->ioctl_cmds.sensebuf = NULL;