MFC r264307:

Fix three refcounter leaks and lock recursion they covered.

1 files changed, 4 insertions, 7 deletions

diff --git a/sys/cam/ctl/ctl_frontend_iscsi.c b/sys/cam/ctl/ctl_frontend_iscsi.c
index 597c0fb..fecfbc2 100644
--- a/sys/cam/ctl/ctl_frontend_iscsi.c
+++ b/sys/cam/ctl/ctl_frontend_iscsi.c
@@ -1448,6 +1448,7 @@ cfiscsi_ioctl_handoff(struct ctl_iscsi *ci)
 		mtx_unlock(&cfiscsi_softc.lock);
 		snprintf(ci->error_str, sizeof(ci->error_str), "connection not found");
 		ci->status = CTL_ISCSI_ERROR;
+		cfiscsi_target_release(ct);
 		return;
 	}
 	mtx_unlock(&cfiscsi_softc.lock);
@@ -2086,15 +2087,9 @@ cfiscsi_target_hold(struct cfiscsi_target *ct)
 static void
 cfiscsi_target_release(struct cfiscsi_target *ct)
 {
-	int old;
 	struct cfiscsi_softc *softc;
 
 	softc = ct->ct_softc;
-
-	old = ct->ct_refcount;
-	if (old > 1 && atomic_cmpset_int(&ct->ct_refcount, old, old - 1))
-		return;
-
 	mtx_lock(&softc->lock);
 	if (refcount_release(&ct->ct_refcount)) {
 		TAILQ_REMOVE(&softc->targets, ct, ct_next);
@@ -2271,6 +2266,7 @@ cfiscsi_lun_enable(void *arg, struct ctl_id target_id, int lun_id)
 
 	tmp = strtoul(lun, NULL, 10);
 	cfiscsi_target_set_lun(ct, tmp, lun_id);
+	cfiscsi_target_release(ct);
 	return (0);
 }
 
@@ -2290,8 +2286,9 @@ cfiscsi_lun_disable(void *arg, struct ctl_id target_id, int lun_id)
 				continue;
 			if (ct->ct_luns[i] != lun_id)
 				continue;
+			mtx_unlock(&softc->lock);
 			cfiscsi_target_unset_lun(ct, i);
-			break;
+			return (0);
 		}
 	}
 	mtx_unlock(&softc->lock);