diff options
| author | gibbs <gibbs@FreeBSD.org> | 1997-03-24 01:46:15 +0000 |
|---|---|---|
| committer | gibbs <gibbs@FreeBSD.org> | 1997-03-24 01:46:15 +0000 |
| commit | 9f4b5d5d62c43bc7b59e7908c93de69d467a7535 (patch) | |
| tree | 16b4ce92a8105f5aa69fbc6fd34ad53c3cbe0f9b /sys/scsi | |
| parent | 1d30a41b6e35c7b0426e7006201e8e8ec4fdf0c6 (diff) | |
| download | FreeBSD-src-9f4b5d5d62c43bc7b59e7908c93de69d467a7535.zip FreeBSD-src-9f4b5d5d62c43bc7b59e7908c93de69d467a7535.tar.gz | |
free_xs must be called at splbio(). This is usually the case since the main
caller is scsi_done which the controller interrupt handlers call. In the
case of a non-buffer based transaction, the xs structure is freed by the
process that initiated the transfer in scsi_scsi_cmd. In this case, an
explicit splbio/splx pair around the call to free_xs is required. Without
the splbio protection, the xs free list could be corrupted, and the type
driver's start routine might run without spl protection.
Submitted by: Tor Egge <Tor.Egge@idt.ntnu.no>
Obtained from: PR kern/2891
Diffstat (limited to 'sys/scsi')
| -rw-r--r-- | sys/scsi/scsi_base.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/scsi/scsi_base.c b/sys/scsi/scsi_base.c index 813ebd2..f6222e9 100644 --- a/sys/scsi/scsi_base.c +++ b/sys/scsi/scsi_base.c @@ -8,7 +8,7 @@ * file. * * Written by Julian Elischer (julian@dialix.oz.au) - * $Id: scsi_base.c,v 1.45 1997/02/22 09:44:28 peter Exp $ + * $Id: scsi_base.c,v 1.46 1997/03/23 06:33:46 bde Exp $ */ #include "opt_bounce.h" @@ -616,7 +616,9 @@ retry: * check if anyone else needs to be started up. */ bad: + s = splbio(); free_xs(xs, sc_link, flags); /* includes the 'start' op */ + splx(s); if (bp && retval) { bp->b_error = retval; bp->b_flags |= B_ERROR; |
