⬢ DragonFlyBSD Kernel Audit
DF-3710 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -2324,7 +2324,13 @@
 {
 	struct AdapterControlBlock *acb = (struct AdapterControlBlock *)arg;
 
+	/* Serialize the completion state machine (srb_state transitions
+	 * and arcmsr_srb_complete()) against the ccb timeout callout,
+	 * which runs with isr_lock held (callout_init_lk).  The lock is
+	 * LK_CANRECURSE, so nested acquisition is safe. */
+	ARCMSR_LOCK_ACQUIRE(&acb->isr_lock);
 	arcmsr_interrupt(acb);
+	ARCMSR_LOCK_RELEASE(&acb->isr_lock);
 }
 /*
 ******************************************************************************