Fix locking in periph drivers - don't try to unlock periph

that was already deallocated.

Reviewed by:	scottl
Approved by:	rwatson (mentor)
Sponsored by:	FreeBSD Foundation

3 files changed, 5 insertions, 6 deletions

diff --git a/sys/cam/cam_periph.c b/sys/cam/cam_periph.c
index 26fbc6e..907c801 100644
--- a/sys/cam/cam_periph.c
+++ b/sys/cam/cam_periph.c
@@ -311,8 +311,6 @@ cam_periph_hold(struct cam_periph *periph, int priority)
 	struct mtx *mtx;
 	int error;
 
-	mtx_assert(periph->sim->mtx, MA_OWNED);
-
 	/*
 	 * Increment the reference count on the peripheral
 	 * while we wait for our lock attempt to succeed
@@ -324,6 +322,8 @@ cam_periph_hold(struct cam_periph *periph, int priority)
 		return (ENXIO);
 
 	mtx = periph->sim->mtx;
+	mtx_assert(mtx, MA_OWNED);
+
 	if (mtx == &Giant)
 		mtx = NULL;
 
diff --git a/sys/cam/cam_xpt.c b/sys/cam/cam_xpt.c
index cf3fa2c..755a798 100644
--- a/sys/cam/cam_xpt.c
+++ b/sys/cam/cam_xpt.c
@@ -1595,7 +1595,7 @@ xpt_remove_periph(struct cam_periph *periph)
 {
 	struct cam_ed *device;
 
-	mtx_assert(periph->sim->mtx, MA_OWNED);
+	cam_periph_lock(periph);
 
 	device = periph->path->device;
 
@@ -1615,6 +1615,7 @@ xpt_remove_periph(struct cam_periph *periph)
 	mtx_lock(&xsoftc.xpt_topo_lock);
 	xsoftc.xpt_generation++;
 	mtx_unlock(&xsoftc.xpt_topo_lock);
+	cam_periph_unlock(periph);
 }
 
 
diff --git a/sys/cam/scsi/scsi_da.c b/sys/cam/scsi/scsi_da.c
index f63a9b0..3e1b233 100644
--- a/sys/cam/scsi/scsi_da.c
+++ b/sys/cam/scsi/scsi_da.c
@@ -772,8 +772,8 @@ daclose(struct disk *dp)
 
 	softc->flags &= ~DA_FLAG_OPEN;
 	cam_periph_unhold(periph);
-	cam_periph_release(periph);
 	cam_periph_unlock(periph);
+	cam_periph_release(periph);
 	return (0);	
 }
 
@@ -995,10 +995,8 @@ dacleanup(struct cam_periph *periph)
 		xpt_print(periph->path, "can't remove sysctl context\n");
 	}
 
-	cam_periph_unlock(periph);
 	disk_destroy(softc->disk);
 	callout_drain(&softc->sendordered_c);
-	cam_periph_lock(periph);
 	free(softc, M_DEVBUF);
 }