git: 66c183f43f0c - main - mmc_cam_sim_default_action: do not touch the ccb after dispatching it

[Andriy Gapon]

The branch main has been updated by avg:

URL: https://cgit.FreeBSD.org/src/commit/?id=66c183f43f0c05ed9238ed9c1859c0c9df7b66dd

commit 66c183f43f0c05ed9238ed9c1859c0c9df7b66dd
Author:     Andriy Gapon <avg at FreeBSD.org>
AuthorDate: 2021-07-09 14:53:17 +0000
Commit:     Andriy Gapon <avg at FreeBSD.org>
CommitDate: 2021-07-12 18:29:26 +0000

    mmc_cam_sim_default_action: do not touch the ccb after dispatching it
    
    If MMC_SIM_CAM_REQUEST() is successful the ccb could be running or being
    completed as the method returns.  Modifying the ccb status could override
    whatever status was already set by a MMC driver.
    
    I am not sure what was the purpose of setting the status to CAM_REQ_INVALID
    in the success path.  I assume that it was to catch a possibility that the
    ccb could be completed without its status explicitly set.  So, I am keeping
    the code, it's just moved to before the MMC_SIM_CAM_REQUEST call.
    
    Without this change I was getting random and phantom EIO errors on Rock64
    running off an SD card (dwmmc driver) plus occasional panics like:
      Memory modified after free 0xffffa00003985800(2040) val=6 @ 0xffffa00003985854
      panic: Most recently used by CAM CCB
    
    MFC after:      1 week
---
 sys/cam/mmc/mmc_sim.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sys/cam/mmc/mmc_sim.c b/sys/cam/mmc/mmc_sim.c
index 0bb4c850f8eb..45d706f61d0a 100644
--- a/sys/cam/mmc/mmc_sim.c
+++ b/sys/cam/mmc/mmc_sim.c
@@ -172,11 +172,10 @@ mmc_cam_sim_default_action(struct cam_sim *sim, union ccb *ccb)
 		break;
 	case XPT_MMC_IO:
 	{
+		ccb->ccb_h.status = CAM_REQ_INVALID;
 		rv = MMC_SIM_CAM_REQUEST(mmc_sim->dev, ccb);
 		if (rv != 0)
 			ccb->ccb_h.status = CAM_SIM_QUEUED;
-		else
-			ccb->ccb_h.status = CAM_REQ_INVALID;
 		return;
 		/* NOTREACHED */
 		break;