⬢ DragonFlyBSD Kernel Audit
DF-3844 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
diff -u -p -r /tmp/opencode/fix/p3844_base/raid/mrsas.c /tmp/opencode/fix/p3844_mod/raid/mrsas.c
--- a/sys/dev/raid/mrsas/mrsas.c	2026-09-16 14:47:26.460997453 +0000
+++ b/sys/dev/raid/mrsas/mrsas.c	2026-09-16 14:47:26.460997453 +0000
@@ -2885,13 +2885,22 @@ int mrsas_issue_blocked_cmd(struct mrsas
 
     while (1) {
        if (cmd->cmd_status == ECONNREFUSED){
-           tsleep((void *)&sc->chan, 0, "mrsas_sleep", hz);
+           /* DF-3844: per-command sleep channel, not the shared sc->chan */
+           tsleep((void *)cmd, 0, "mrsas_sleep", hz);
        }
        else
            break;
        total_time++;
        if (total_time >= max_wait) {
            device_printf(sc->mrsas_dev, "Internal command timed out after %d seconds.\n", max_wait);
+           /*
+            * DF-3844: the firmware still owns this command.  Abort it
+            * before the caller releases it back to the free pool,
+            * otherwise a late completion lands on a recycled cmd.
+            */
+           mrsas_issue_blocked_abort_cmd(sc, cmd);
+           if (cmd->cmd_status == ECONNREFUSED)
+               cmd->cmd_status = MFI_STAT_TIMEOUT;
            retcode = 1;
            break;
        } 
@@ -3008,8 +3017,8 @@ void mrsas_wakeup(struct mrsas_softc *sc
     /* For debug only ... */ 
     //device_printf(sc->mrsas_dev,"DCMD rec'd for wakeup, sc->chan=%p\n", sc->chan);
 
-    sc->chan = (void*)&cmd;
-    wakeup_one((void *)&sc->chan);
+    /* DF-3844: wake the exact waiter for this command */
+    wakeup_one((void *)cmd);
     return;
 }
 
diff -u -p -r /tmp/opencode/fix/p3844_base/raid/mrsas_ioctl.c /tmp/opencode/fix/p3844_mod/raid/mrsas_ioctl.c
--- a/sys/dev/raid/mrsas/mrsas_ioctl.c	2026-09-16 14:47:26.460997453 +0000
+++ b/sys/dev/raid/mrsas/mrsas_ioctl.c	2026-09-16 14:47:26.460997453 +0000
@@ -298,7 +298,13 @@ int mrsas_passthru( struct mrsas_softc *
      * cmd to the SCSI mid-layer
      */
     cmd->sync_cmd = 1;
-    mrsas_issue_blocked_cmd(sc, cmd);
+    if (mrsas_issue_blocked_cmd(sc, cmd)) {
+        /* DF-3844: timed-out cmd was aborted; do not use its data */
+        cmd->sync_cmd = 0;
+        device_printf(sc->mrsas_dev, "IOCTL passthrough timed out\n");
+        ret = EIO;
+        goto out;
+    }
     cmd->sync_cmd = 0;
 
     /*