svn commit: r306698 - stable/11/sys/cam

[Mark Johnston]

Author: markj
Date: Wed Oct  5 00:33:52 2016
New Revision: 306698
URL: https://svnweb.freebsd.org/changeset/base/306698

Log:
  MFC r306061:
  Protect ccbq access with devq->send_mtx in the XPT_ABORT handler.

Modified:
  stable/11/sys/cam/cam_xpt.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/cam/cam_xpt.c
==============================================================================
--- stable/11/sys/cam/cam_xpt.c	Wed Oct  5 00:33:06 2016	(r306697)
+++ stable/11/sys/cam/cam_xpt.c	Wed Oct  5 00:33:52 2016	(r306698)
@@ -2565,21 +2565,25 @@ xpt_action_default(union ccb *start_ccb)
 
 		abort_ccb = start_ccb->cab.abort_ccb;
 		if (XPT_FC_IS_DEV_QUEUED(abort_ccb)) {
+			struct cam_ed *device;
+			struct cam_devq *devq;
+
+			device = abort_ccb->ccb_h.path->device;
+			devq = device->sim->devq;
 
-			if (abort_ccb->ccb_h.pinfo.index >= 0) {
-				struct cam_ccbq *ccbq;
-				struct cam_ed *device;
-
-				device = abort_ccb->ccb_h.path->device;
-				ccbq = &device->ccbq;
-				cam_ccbq_remove_ccb(ccbq, abort_ccb);
+			mtx_lock(&devq->send_mtx);
+			if (abort_ccb->ccb_h.pinfo.index > 0) {
+				cam_ccbq_remove_ccb(&device->ccbq, abort_ccb);
 				abort_ccb->ccb_h.status =
 				    CAM_REQ_ABORTED|CAM_DEV_QFRZN;
-				xpt_freeze_devq(abort_ccb->ccb_h.path, 1);
+				xpt_freeze_devq_device(device, 1);
+				mtx_unlock(&devq->send_mtx);
 				xpt_done(abort_ccb);
 				start_ccb->ccb_h.status = CAM_REQ_CMP;
 				break;
 			}
+			mtx_unlock(&devq->send_mtx);
+
 			if (abort_ccb->ccb_h.pinfo.index == CAM_UNQUEUED_INDEX
 			 && (abort_ccb->ccb_h.status & CAM_SIM_QUEUED) == 0) {
 				/*