avoid use after free
authorPeter Avalos <pavalos@dragonflybsd.org>
Thu, 29 Nov 2007 02:56:42 +0000 (02:56 +0000)
committerPeter Avalos <pavalos@dragonflybsd.org>
Thu, 29 Nov 2007 02:56:42 +0000 (02:56 +0000)
Obtained-from: FreeBSD

sys/bus/cam/scsi/scsi_sa.c

index dcc78f9..2d6408e 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * $FreeBSD: src/sys/cam/scsi/scsi_sa.c,v 1.45.2.13 2002/12/17 17:08:50 trhodes Exp $
- * $DragonFly: src/sys/bus/cam/scsi/scsi_sa.c,v 1.29 2007/11/28 20:56:55 pavalos Exp $
+ * $DragonFly: src/sys/bus/cam/scsi/scsi_sa.c,v 1.30 2007/11/29 02:56:42 pavalos Exp $
  *
  * Implementation of SCSI Sequential Access Peripheral driver for CAM.
  *
@@ -1850,8 +1850,8 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
                         * will now attempt to rewind/load it.
                         */
                        softc->flags &= ~SA_FLAG_TAPE_MOUNTED;
-                       if (CAM_DEBUGGED(ccb->ccb_h.path, CAM_DEBUG_INFO)) {
-                               xpt_print_path(ccb->ccb_h.path);
+                       if (CAM_DEBUGGED(periph->path, CAM_DEBUG_INFO)) {
+                               xpt_print_path(periph->path);
                                kprintf("error %d on TUR in samount\n", error);
                        }
                }
@@ -1929,7 +1929,7 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
                            &softc->device_stats);
                        QFRLS(ccb);
                        if (error) {
-                               xpt_print_path(ccb->ccb_h.path);
+                               xpt_print_path(periph->path);
                                kprintf("unable to rewind after test read\n");
                                xpt_release_ccb(ccb);
                                goto exit;
@@ -2094,7 +2094,7 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
                if ((softc->max_blk < softc->media_blksize) ||
                    (softc->min_blk > softc->media_blksize &&
                    softc->media_blksize)) {
-                       xpt_print_path(ccb->ccb_h.path);
+                       xpt_print_path(periph->path);
                        kprintf("BLOCK LIMITS (%d..%d) could not match current "
                            "block settings (%d)- adjusting\n", softc->min_blk,
                            softc->max_blk, softc->media_blksize);
@@ -2129,7 +2129,7 @@ tryagain:
                        error = sasetparams(periph, SA_PARAM_BLOCKSIZE,
                            softc->media_blksize, 0, 0, SF_NO_PRINT);
                        if (error) {
-                               xpt_print_path(ccb->ccb_h.path);
+                               xpt_print_path(periph->path);
                                kprintf("unable to set fixed blocksize to %d\n",
                                     softc->media_blksize);
                                goto exit;
@@ -2156,7 +2156,7 @@ tryagain:
                                                softc->last_media_blksize = 512;
                                        goto tryagain;
                                }
-                               xpt_print_path(ccb->ccb_h.path);
+                               xpt_print_path(periph->path);
                                kprintf("unable to set variable blocksize\n");
                                goto exit;
                        }
@@ -2214,7 +2214,7 @@ tryagain:
                        if (error == 0) {
                                softc->buffer_mode = SMH_SA_BUF_MODE_SIBUF;
                        } else {
-                               xpt_print_path(ccb->ccb_h.path);
+                               xpt_print_path(periph->path);
                                kprintf("unable to set buffered mode\n");
                        }
                        error = 0;      /* not an error */