[Midnightbsd-cvs] src [8807] trunk/sys/cam/scsi/scsi_enc.c: fix ref counting and lifetime issues.

[laffer1 at midnightbsd.org]

Revision: 8807
          http://svnweb.midnightbsd.org/src/?rev=8807
Author:   laffer1
Date:     2016-09-25 23:32:16 -0400 (Sun, 25 Sep 2016)
Log Message:
-----------
fix ref counting and lifetime issues.

Modified Paths:
--------------
    trunk/sys/cam/scsi/scsi_enc.c

Modified: trunk/sys/cam/scsi/scsi_enc.c
===================================================================
--- trunk/sys/cam/scsi/scsi_enc.c	2016-09-26 03:31:35 UTC (rev 8806)
+++ trunk/sys/cam/scsi/scsi_enc.c	2016-09-26 03:32:16 UTC (rev 8807)
@@ -109,6 +109,16 @@
 }
 
 static void
+enc_devgonecb(void *arg)
+{
+	struct cam_periph *periph;
+
+	periph = (struct cam_periph *)arg;
+
+	cam_periph_release(periph);
+}
+
+static void
 enc_oninvalidate(struct cam_periph *periph)
 {
 	struct enc_softc *enc;
@@ -136,6 +146,8 @@
 	}
 	callout_drain(&enc->status_updater);
 
+	destroy_dev_sched_cb(enc->enc_dev, enc_devgonecb, periph);
+
 	xpt_print(periph->path, "lost device\n");
 }
 
@@ -147,10 +159,8 @@
 	enc = periph->softc;
 
 	xpt_print(periph->path, "removing device entry\n");
-	cam_periph_unlock(periph);
-	destroy_dev(enc->enc_dev);
-	cam_periph_lock(periph);
 
+
 	/* If the sub-driver has a cleanup routine, call it */
 	if (enc->enc_vec.softc_cleanup != NULL)
 		enc->enc_vec.softc_cleanup(enc);
@@ -935,9 +945,19 @@
 			goto out;
 		}
 	}
+
+	if (cam_periph_acquire(periph) != CAM_REQ_CMP) {
+		xpt_print(periph->path, "%s: lost periph during "
+			  "registration!\n", __func__);
+		cam_periph_lock(periph);
+
+		return (CAM_REQ_CMP_ERR);
+	}
+
 	enc->enc_dev = make_dev(&enc_cdevsw, periph->unit_number,
 	    UID_ROOT, GID_OPERATOR, 0600, "%s%d",
 	    periph->periph_name, periph->unit_number);
+
 	cam_periph_lock(periph);
 	enc->enc_dev->si_drv1 = periph;