From b7a38744ed230a32aa776fc1d19950f0dd5cb0db Mon Sep 17 00:00:00 2001 From: mav Date: Fri, 28 Nov 2014 09:23:15 +0000 Subject: [PATCH] MFC r274756: Remove residual xpt_release_device() call left after r272406 cleanup. Excessive release here could trigger use-after-free condition and kernel panic on LUN 0 disconnect. git-svn-id: svn://svn.freebsd.org/base/stable/10@275204 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/cam/scsi/scsi_xpt.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/sys/cam/scsi/scsi_xpt.c b/sys/cam/scsi/scsi_xpt.c index 56dada4ed..526aa4167 100644 --- a/sys/cam/scsi/scsi_xpt.c +++ b/sys/cam/scsi/scsi_xpt.c @@ -2041,23 +2041,7 @@ scsi_scan_bus(struct cam_periph *periph, union ccb *request_ccb) scan_info->lunindex[target_id]++; } else { mtx_unlock(&target->luns_mtx); - /* - * We're done with scanning all luns. - * - * Nuke the bogus device for lun 0 if lun 0 - * wasn't on the list. - */ - if (first != 0) { - TAILQ_FOREACH(device, - &target->ed_entries, links) { - if (device->lun_id == 0) { - break; - } - } - if (device) { - xpt_release_device(device); - } - } + /* We're done with scanning all luns. */ } } else { mtx_unlock(&target->luns_mtx); -- 2.45.0