Fix DF-4251: mprsas_SSU_to_SATA_devices leaks mpr_lock on two error paths. The lock is taken at the top (mpr_sas_lsi.c:1479); the xpt_alloc_ccb() failure return (:1501) and the xpt_create_path() failure return (:1510) both bypass the only mpr_unlock() after the target loop (:1541). Runs from mprsas_ir_shutdown() at system shutdown: after either error return the adapter lock is permanently owned by a dead thread; every later mpr_lock user (mpr_intr, the periodic callout, cam teardown/detach) blocks forever and shutdown wedges. Verified live (rig, baseline kernel #0): the REAL production mprsas_SSU_to_SATA_devices, dispatched under exactly the production xpt_create_path failure condition (unregistered bus id -> CAM_PATH_INVALID), returned with lockstatus()==LK_EXCLUSIVE and a kernel thread then blocked on mpr_lock indefinitely until the rig released it. With this fix the same dispatch returns with the lock released (lockstatus()==0). --- a/sys/dev/raid/mpr/mpr_sas_lsi.c +++ b/sys/dev/raid/mpr/mpr_sas_lsi.c @@ -1498,7 +1506,7 @@ if (ccb == NULL) { mpr_dprint(sc, MPR_FAULT, "Unable to alloc CCB " "to stop unit.\n"); - return; + goto out_unlock; } if (xpt_create_path(&ccb->ccb_h.path, xpt_periph, @@ -1507,7 +1515,7 @@ mpr_dprint(sc, MPR_ERROR, "Unable to create " "path to stop unit.\n"); xpt_free_ccb(&ccb->ccb_h); - return; + goto out_unlock; } xpt_path_string(ccb->ccb_h.path, path_str, sizeof(path_str)); @@ -1538,6 +1546,7 @@ } } +out_unlock: mpr_unlock(sc); /*