svn commit: r198782 - head/sys/cam

[Alexander Motin]

Author: mav
Date: Mon Nov  2 08:31:00 2009
New Revision: 198782
URL: http://svn.freebsd.org/changeset/base/198782

Log:
  The async callback could free the device. If it is a broadcast async,
  it doesn't hold device reference, so take our own reference.
  
  Submitted by:   thompsa

Modified:
  head/sys/cam/cam_xpt.c

Modified: head/sys/cam/cam_xpt.c
==============================================================================
--- head/sys/cam/cam_xpt.c	Mon Nov  2 07:21:13 2009	(r198781)
+++ head/sys/cam/cam_xpt.c	Mon Nov  2 08:31:00 2009	(r198782)
@@ -4022,13 +4022,19 @@ xpt_async(u_int32_t async_code, struct c
 			 && path->device->lun_id != CAM_LUN_WILDCARD
 			 && device->lun_id != CAM_LUN_WILDCARD)
 				continue;
-
+			/*
+			 * The async callback could free the device.
+			 * If it is a broadcast async, it doesn't hold
+			 * device reference, so take our own reference.
+			 */
+			xpt_acquire_device(device);
 			(*(bus->xport->async))(async_code, bus,
 					       target, device,
 					       async_arg);
 
 			xpt_async_bcast(&device->asyncs, async_code,
 					path, async_arg);
+			xpt_release_device(device);
 		}
 	}