git: f5ca54f31268 - stable/13 - mmc_cam_sim_default_action: do not touch the ccb after dispatching it

[Emmanuel Vadot]

The branch stable/13 has been updated by manu:

URL: https://cgit.FreeBSD.org/src/commit/?id=f5ca54f31268534b8b2032aa888e5b6870062dae

commit f5ca54f31268534b8b2032aa888e5b6870062dae
Author:     Andriy Gapon <avg at FreeBSD.org>
AuthorDate: 2021-07-09 14:53:17 +0000
Commit:     Emmanuel Vadot <manu at FreeBSD.org>
CommitDate: 2021-07-22 17:19:38 +0000

    mmc_cam_sim_default_action: do not touch the ccb after dispatching it
    
    If MMC_SIM_CAM_REQUEST() is successful the ccb could be running or being
    completed as the method returns.  Modifying the ccb status could override
    whatever status was already set by a MMC driver.
    
    I am not sure what was the purpose of setting the status to CAM_REQ_INVALID
    in the success path.  I assume that it was to catch a possibility that the
    ccb could be completed without its status explicitly set.  So, I am keeping
    the code, it's just moved to before the MMC_SIM_CAM_REQUEST call.
    
    Without this change I was getting random and phantom EIO errors on Rock64
    running off an SD card (dwmmc driver) plus occasional panics like:
      Memory modified after free 0xffffa00003985800(2040) val=6 @ 0xffffa00003985854
      panic: Most recently used by CAM CCB
    
    MFC after:      1 week
    
    (cherry picked from commit 66c183f43f0c05ed9238ed9c1859c0c9df7b66dd)
---
 sys/cam/mmc/mmc_sim.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sys/cam/mmc/mmc_sim.c b/sys/cam/mmc/mmc_sim.c
index 1500e3f6f1cd..6fe38f26d339 100644
--- a/sys/cam/mmc/mmc_sim.c
+++ b/sys/cam/mmc/mmc_sim.c
@@ -150,11 +150,10 @@ mmc_cam_sim_default_action(struct cam_sim *sim, union ccb *ccb)
 		break;
 	case XPT_MMC_IO:
 	{
+		ccb->ccb_h.status = CAM_REQ_INVALID;
 		rv = MMC_SIM_CAM_REQUEST(mmc_sim->dev, ccb);
 		if (rv != 0)
 			ccb->ccb_h.status = CAM_SIM_QUEUED;
-		else
-			ccb->ccb_h.status = CAM_REQ_INVALID;
 		return;
 		/* NOTREACHED */
 		break;