svn commit: r363260 - head/sys/cam

[Kenneth D. Merry]

Author: ken
Date: Thu Jul 16 20:43:28 2020
New Revision: 363260
URL: https://svnweb.freebsd.org/changeset/base/363260

Log:
  Hold the mutex when releasing a callout.
  
  In xpt_release_device(), callout_stop() was being called without
  holding the mutex (send_mtx) that is used to protect the callout.
  
  So, move the mtx_unlock() call so that it is protected.
  
  MFC after:	1 week
  Sponsored by:	Spectra Logic

Modified:
  head/sys/cam/cam_xpt.c

Modified: head/sys/cam/cam_xpt.c
==============================================================================
--- head/sys/cam/cam_xpt.c	Thu Jul 16 20:36:22 2020	(r363259)
+++ head/sys/cam/cam_xpt.c	Thu Jul 16 20:43:28 2020	(r363260)
@@ -4959,15 +4959,17 @@ xpt_release_device(struct cam_ed *device)
 	devq = bus->sim->devq;
 	mtx_lock(&devq->send_mtx);
 	cam_devq_resize(devq, devq->send_queue.array_size - 1);
-	mtx_unlock(&devq->send_mtx);
 
 	KASSERT(SLIST_EMPTY(&device->periphs),
 	    ("destroying device, but periphs list is not empty"));
 	KASSERT(device->devq_entry.index == CAM_UNQUEUED_INDEX,
 	    ("destroying device while still queued for ccbs"));
 
+	/* The send_mtx must be held when accessing the callout */
 	if ((device->flags & CAM_DEV_REL_TIMEOUT_PENDING) != 0)
 		callout_stop(&device->callout);
+
+	mtx_unlock(&devq->send_mtx);
 
 	xpt_release_target(device->target);