Fix refcount locking in cd, pass, and sg periphs.

3 files changed, 13 insertions, 11 deletions

diff --git a/sys/cam/scsi/scsi_cd.c b/sys/cam/scsi/scsi_cd.c
index f8fe11d..383d703 100644
--- a/sys/cam/scsi/scsi_cd.c
+++ b/sys/cam/scsi/scsi_cd.c
@@ -996,12 +996,6 @@ cdopen(struct disk *dp)
 		return (error);
 	}
 
-	/* Closes aren't symmetrical with opens, so fix up the refcounting. */
-	if (softc->flags & CD_FLAG_OPEN)
-		cam_periph_release(periph);
-	else
-		softc->flags |= CD_FLAG_OPEN;
-
 	/*
 	 * Check for media, and set the appropriate flags.  We don't bail
 	 * if we don't have media, but then we don't allow anything but the
@@ -1011,7 +1005,15 @@ cdopen(struct disk *dp)
 
 	CAM_DEBUG(periph->path, CAM_DEBUG_TRACE, ("leaving cdopen\n"));
 	cam_periph_unhold(periph);
-	cam_periph_unlock(periph);
+
+	/* Closes aren't symmetrical with opens, so fix up the refcounting. */
+	if ((softc->flags & CD_FLAG_OPEN) == 0) {
+		softc->flags |= CD_FLAG_OPEN;
+		cam_periph_unlock(periph);
+	} else {
+		cam_periph_unlock(periph);
+		cam_periph_release(periph);
+	}
 
 	return (0);
 }
diff --git a/sys/cam/scsi/scsi_pass.c b/sys/cam/scsi/scsi_pass.c
index 1f5f089..16ecec4 100644
--- a/sys/cam/scsi/scsi_pass.c
+++ b/sys/cam/scsi/scsi_pass.c
@@ -346,13 +346,13 @@ passopen(struct cdev *dev, int flags, int fmt, struct thread *td)
 
 	if ((softc->flags & PASS_FLAG_OPEN) == 0) {
 		softc->flags |= PASS_FLAG_OPEN;
+		cam_periph_unlock(periph);
 	} else {
 		/* Device closes aren't symmertical, so fix up the refcount */
+		cam_periph_unlock(periph);
 		cam_periph_release(periph);
 	}
 
-	cam_periph_unlock(periph);
-
 	return (error);
 }
 
diff --git a/sys/cam/scsi/scsi_sg.c b/sys/cam/scsi/scsi_sg.c
index af2ab6e..6daf6ff 100644
--- a/sys/cam/scsi/scsi_sg.c
+++ b/sys/cam/scsi/scsi_sg.c
@@ -399,13 +399,13 @@ sgopen(struct cdev *dev, int flags, int fmt, struct thread *td)
 
 	if ((softc->flags & SG_FLAG_OPEN) == 0) {
 		softc->flags |= SG_FLAG_OPEN;
+		cam_periph_unlock(periph);
 	} else {
 		/* Device closes aren't symmetrical, fix up the refcount. */
+		cam_periph_unlock(periph);
 		cam_periph_release(periph);
 	}
 
-	cam_periph_unlock(periph);
-
 	return (error);
 }