aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWarner Losh <imp@FreeBSD.org>2026-04-24 18:31:13 +0000
committerWarner Losh <imp@FreeBSD.org>2026-04-24 18:32:24 +0000
commit3454d97aaec12f4a8c676c34182200471eecae24 (patch)
tree6a827a7d16aa29a2657da5149c26e5de4108d782
parente1cff854997884ed9b7251d409d9c9c7a025606d (diff)
cam: Set ccb_h.status on XPT_GDEVLIST early-return paths
XPT_GDEVLIST in xpt_action_default has two early-return paths (list changed and index not found) that set cgdl->status but not ccb_h.status. Since xpt_action sets ccb_h.status to CAM_REQ_INPROG before dispatching, and XPT_GDEVLIST is an non-queued CCB, cam_periph_ccbwait skips the sleep loop and immediately hits the KASSERT checking that status != CAM_REQ_INPROG, causing a panic. Set ccb_h.status = CAM_REQ_CMP at the top of the code rather than the bottom. Any future error paths will be right (since this command can't fail at the command level, just in the status of the data level). PR: 293899 Assisted-By: Claude Opus 4.6 (1M context) Sponsored by: Netflix Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D56487
-rw-r--r--sys/cam/cam_xpt.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/cam/cam_xpt.c b/sys/cam/cam_xpt.c
index f43dde8de401..605f4d8c3cf0 100644
--- a/sys/cam/cam_xpt.c
+++ b/sys/cam/cam_xpt.c
@@ -2779,6 +2779,7 @@ call_sim:
device = path->device;
periph_head = &device->periphs;
cgdl = &start_ccb->cgdl;
+ start_ccb->ccb_h.status = CAM_REQ_CMP;
/*
* Check and see if the list has changed since the user
@@ -2820,7 +2821,6 @@ call_sim:
cgdl->index++;
cgdl->generation = device->generation;
- cgdl->ccb_h.status = CAM_REQ_CMP;
break;
}
case XPT_DEV_MATCH: