⬢ DragonFlyBSD Kernel Audit
DF-2263 / fix226x_all.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
--- a/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:47.605472930 +0000
+++ b/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:56.397360042 +0000
@@ -1622,6 +1622,7 @@
 				bp->b_error = 0;
 				if (bioq_first(&softc->bio_queue) != NULL) {
 					biodone(done_bio);
+					bio = bioq_first(&softc->bio_queue);
 					goto again;
 				}
 			} else if ((softc->flags & SA_FLAG_EIO_PENDING) != 0) {
--- a/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:47.605472930 +0000
+++ b/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:56.409359887 +0000
@@ -875,7 +875,7 @@
 			if ((periph->flags & CAM_PERIPH_LOCKED) == 0) {
 				error = cam_periph_hold(periph, PCATCH);
 				if (error != 0) {
-					return (error);
+					goto out_locked;
 				}
 				didholdperiph = 1;
 			}
@@ -911,13 +911,14 @@
 			 */
 			error = cam_periph_hold(periph, PCATCH);
 			if (error != 0) {
-				return (error);
+				goto out_locked;
 			}
 			didholdperiph = 1;
 			break;
 
 		default:
-			return (EINVAL);
+			error = EINVAL;
+			goto out_locked;
 		}
 	}
 
@@ -1344,6 +1345,10 @@
 	else
 		cam_periph_unlock(periph);
 	return (error);
+
+out_locked:
+	cam_periph_unlock(periph);
+	return (error);
 }
 
 static void
--- a/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:47.605472930 +0000
+++ b/sys/bus/cam/scsi/scsi_sa.c	2026-10-17 18:26:56.409359887 +0000
@@ -2937,6 +2937,7 @@
 			 */
 			if (params_to_set == SA_PARAM_NONE) {
 				kfree(mode_buffer, M_SCSISA);
+				kfree(ccomp, M_SCSISA);
 				xpt_release_ccb(ccb);
 				return (ENODEV);
 			}