Close a race in ata_reinit().

2 files changed, 7 insertions, 3 deletions

diff --git a/sys/dev/ata/ata-all.c b/sys/dev/ata/ata-all.c
index 80c921a..ebd069c 100644
--- a/sys/dev/ata/ata-all.c
+++ b/sys/dev/ata/ata-all.c
@@ -190,6 +190,11 @@ ata_detach(device_t dev)
     /* fail outstanding requests on this channel */
     ata_fail_requests(ch, NULL);
 
+    /* unlock the channel */
+    ch->running = NULL;
+    ATA_UNLOCK_CH(ch);
+    ch->locking(ch, ATA_LF_UNLOCK);
+
     /* detach devices on this channel */
     if (ch->device[MASTER].detach)
 	ch->device[MASTER].detach(&ch->device[MASTER]);
@@ -265,8 +270,10 @@ ata_reinit(struct ata_channel *ch)
 	}
     }
 
+    /* unlock the channel */
     ch->running = NULL;
     ATA_UNLOCK_CH(ch);
+    ch->locking(ch, ATA_LF_UNLOCK);
 
     /* identify what is present on the channel now */
     ata_identify_devices(ch);
diff --git a/sys/dev/ata/ata-queue.c b/sys/dev/ata/ata-queue.c
index 34edd2d..cf07991 100644
--- a/sys/dev/ata/ata-queue.c
+++ b/sys/dev/ata/ata-queue.c
@@ -483,9 +483,6 @@ ata_fail_requests(struct ata_channel *ch, struct ata_device *device)
     /* if we have a request "in flight" fail it as well */
     if ((request = ch->running) && (!device || request->device == device)) {
 	untimeout((timeout_t *)ata_timeout, request, request->timeout_handle);
-	ATA_UNLOCK_CH(request->device->channel);
-	request->device->channel->locking(request->device->channel,
-					  ATA_LF_UNLOCK);
 	request->result = ENXIO;
 	if (request->callback)
 	    (request->callback)(request);