⬢ DragonFlyBSD Kernel Audit
DF-3965 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.056779292 +0000
+++ b/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.128778373 +0000
@@ -390,21 +390,22 @@ srb_complete:
 			goto scsi_done;
 		}
 
+		/* release the map on ALL completions, not only success */
+		switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
+		case CAM_DIR_IN:
+			bus_dmamap_sync(hba->io_dmat,
+				srb->dma_map, BUS_DMASYNC_POSTREAD);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		case CAM_DIR_OUT:
+			bus_dmamap_sync(hba->io_dmat,
+				srb->dma_map, BUS_DMASYNC_POSTWRITE);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		}
+
 		switch (result) {
 		case IOP_RESULT_SUCCESS:
-			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
-			case CAM_DIR_IN:
-				bus_dmamap_sync(hba->io_dmat,
-					srb->dma_map, BUS_DMASYNC_POSTREAD);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			case CAM_DIR_OUT:
-				bus_dmamap_sync(hba->io_dmat,
-					srb->dma_map, BUS_DMASYNC_POSTWRITE);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			}
-
 			ccb->ccb_h.status = CAM_REQ_CMP;
 			break;
 
@@ -544,20 +545,22 @@ static void hptiop_request_callback_mv(s
 		if (context & MVIOP_MU_QUEUE_REQUEST_RESULT_BIT)
 			req->header.result = IOP_RESULT_SUCCESS;
 
+		/* release the map on ALL completions, not only success */
+		switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
+		case CAM_DIR_IN:
+			bus_dmamap_sync(hba->io_dmat,
+				srb->dma_map, BUS_DMASYNC_POSTREAD);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		case CAM_DIR_OUT:
+			bus_dmamap_sync(hba->io_dmat,
+				srb->dma_map, BUS_DMASYNC_POSTWRITE);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		}
+
 		switch (req->header.result) {
 		case IOP_RESULT_SUCCESS:
-			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
-			case CAM_DIR_IN:
-				bus_dmamap_sync(hba->io_dmat,
-					srb->dma_map, BUS_DMASYNC_POSTREAD);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			case CAM_DIR_OUT:
-				bus_dmamap_sync(hba->io_dmat,
-					srb->dma_map, BUS_DMASYNC_POSTWRITE);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			}
 			ccb->ccb_h.status = CAM_REQ_CMP;
 			break;
 		case IOP_RESULT_BAD_TARGET:
@@ -651,20 +654,22 @@ static void hptiop_request_callback_mvfr
 		if (_tag & MVFREYIOPMU_QUEUE_REQUEST_RESULT_BIT)
 			req->header.result = IOP_RESULT_SUCCESS;
 
+		/* release the map on ALL completions, not only success */
+		switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
+		case CAM_DIR_IN:
+			bus_dmamap_sync(hba->io_dmat,
+					srb->dma_map, BUS_DMASYNC_POSTREAD);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		case CAM_DIR_OUT:
+			bus_dmamap_sync(hba->io_dmat,
+					srb->dma_map, BUS_DMASYNC_POSTWRITE);
+			bus_dmamap_unload(hba->io_dmat, srb->dma_map);
+			break;
+		}
+
 		switch (req->header.result) {
 		case IOP_RESULT_SUCCESS:
-			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
-			case CAM_DIR_IN:
-				bus_dmamap_sync(hba->io_dmat,
-						srb->dma_map, BUS_DMASYNC_POSTREAD);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			case CAM_DIR_OUT:
-				bus_dmamap_sync(hba->io_dmat,
-						srb->dma_map, BUS_DMASYNC_POSTWRITE);
-				bus_dmamap_unload(hba->io_dmat, srb->dma_map);
-				break;
-			}
 			ccb->ccb_h.status = CAM_REQ_CMP;
 			break;
 		case IOP_RESULT_BAD_TARGET: