From df602c9dc237323e0c42896275b9723a6d365431 Mon Sep 17 00:00:00 2001
From: Peter Avalos <pavalos@dragonflybsd.org>
Date: Thu, 29 Nov 2007 02:56:42 +0000
Subject: [PATCH] avoid use after free

Obtained-from: FreeBSD
---
 sys/bus/cam/scsi/scsi_sa.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/sys/bus/cam/scsi/scsi_sa.c b/sys/bus/cam/scsi/scsi_sa.c
index dcc78f9141..2d6408ed06 100644
--- a/sys/bus/cam/scsi/scsi_sa.c
+++ b/sys/bus/cam/scsi/scsi_sa.c
@@ -1,6 +1,6 @@
 /*
  * $FreeBSD: src/sys/cam/scsi/scsi_sa.c,v 1.45.2.13 2002/12/17 17:08:50 trhodes Exp $
- * $DragonFly: src/sys/bus/cam/scsi/scsi_sa.c,v 1.29 2007/11/28 20:56:55 pavalos Exp $
+ * $DragonFly: src/sys/bus/cam/scsi/scsi_sa.c,v 1.30 2007/11/29 02:56:42 pavalos Exp $
  *
  * Implementation of SCSI Sequential Access Peripheral driver for CAM.
  *
@@ -1850,8 +1850,8 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
 			 * will now attempt to rewind/load it.
 			 */
 			softc->flags &= ~SA_FLAG_TAPE_MOUNTED;
-			if (CAM_DEBUGGED(ccb->ccb_h.path, CAM_DEBUG_INFO)) {
-				xpt_print_path(ccb->ccb_h.path);
+			if (CAM_DEBUGGED(periph->path, CAM_DEBUG_INFO)) {
+				xpt_print_path(periph->path);
 				kprintf("error %d on TUR in samount\n", error);
 			}
 		}
@@ -1929,7 +1929,7 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
 			    &softc->device_stats);
 			QFRLS(ccb);
 			if (error) {
-				xpt_print_path(ccb->ccb_h.path);
+				xpt_print_path(periph->path);
 				kprintf("unable to rewind after test read\n");
 				xpt_release_ccb(ccb);
 				goto exit;
@@ -2094,7 +2094,7 @@ samount(struct cam_periph *periph, int oflags, cdev_t dev)
 		if ((softc->max_blk < softc->media_blksize) ||
 		    (softc->min_blk > softc->media_blksize &&
 		    softc->media_blksize)) {
-			xpt_print_path(ccb->ccb_h.path);
+			xpt_print_path(periph->path);
 			kprintf("BLOCK LIMITS (%d..%d) could not match current "
 			    "block settings (%d)- adjusting\n", softc->min_blk,
 			    softc->max_blk, softc->media_blksize);
@@ -2129,7 +2129,7 @@ tryagain:
 			error = sasetparams(periph, SA_PARAM_BLOCKSIZE,
 			    softc->media_blksize, 0, 0, SF_NO_PRINT);
 			if (error) {
-				xpt_print_path(ccb->ccb_h.path);
+				xpt_print_path(periph->path);
 				kprintf("unable to set fixed blocksize to %d\n",
 				     softc->media_blksize);
 				goto exit;
@@ -2156,7 +2156,7 @@ tryagain:
 						softc->last_media_blksize = 512;
 					goto tryagain;
 				}
-				xpt_print_path(ccb->ccb_h.path);
+				xpt_print_path(periph->path);
 				kprintf("unable to set variable blocksize\n");
 				goto exit;
 			}
@@ -2214,7 +2214,7 @@ tryagain:
 			if (error == 0) {
 				softc->buffer_mode = SMH_SA_BUF_MODE_SIBUF;
 			} else {
-				xpt_print_path(ccb->ccb_h.path);
+				xpt_print_path(periph->path);
 				kprintf("unable to set buffered mode\n");
 			}
 			error = 0;	/* not an error */
-- 
2.41.0