git: 5f7c2adceb5c - stable/15 - ufshci: do not free the devq twice on SIM attach failure

The branch stable/15 has been updated by jaeyoon:

URL: https://cgit.FreeBSD.org/src/commit/?id=5f7c2adceb5c3df28a24e8c6f0287f4a5b640263

commit 5f7c2adceb5c3df28a24e8c6f0287f4a5b640263
Author:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
AuthorDate: 2026-08-10 01:44:35 +0000
Commit:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
CommitDate: 2026-10-06 06:27:58 +0000

    ufshci: do not free the devq twice on SIM attach failure
    
    cam_sim_free() with free_devq set already frees the devq, so the
    following cam_simq_free() call on the xpt_bus_register() and
    xpt_create_path() failure paths was a double free. Also clear
    ctrlr->ufshci_sim so a later ufshci_sim_detach() does not operate on
    the freed SIM.
    
    Sponsored by:           Samsung Electronics
    Reviewed by:            imp (mentor)
    Differential Revision:  https://reviews.freebsd.org/D58662
    
    (cherry picked from commit c71705a0830497c080579896b4aa2a5ce2513f1c)
---
 sys/dev/ufshci/ufshci_sim.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sys/dev/ufshci/ufshci_sim.c b/sys/dev/ufshci/ufshci_sim.c
index 9d80dd195ad9..4a106a6c7b8a 100644
--- a/sys/dev/ufshci/ufshci_sim.c
+++ b/sys/dev/ufshci/ufshci_sim.c
@@ -371,8 +371,9 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr)
 
 	mtx_lock(&ctrlr->sc_mtx);
 	if (xpt_bus_register(ctrlr->ufshci_sim, ctrlr->dev, 0) != CAM_SUCCESS) {
+		/* cam_sim_free() with free_devq also frees the devq. */
 		cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE);
-		cam_simq_free(devq);
+		ctrlr->ufshci_sim = NULL;
 		mtx_unlock(&ctrlr->sc_mtx);
 		printf("Failed to create a bus\n");
 		return (ENOMEM);
@@ -383,7 +384,7 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr)
 		CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
 		xpt_bus_deregister(cam_sim_path(ctrlr->ufshci_sim));
 		cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE);
-		cam_simq_free(devq);
+		ctrlr->ufshci_sim = NULL;
 		mtx_unlock(&ctrlr->sc_mtx);
 		printf("Failed to create a path\n");
 		return (ENOMEM);