Andreas Gunnarsson found a bug in iha that causes system crashes when running a DIAGNOSTIC kernel. This was exposed by the recent migration of the SCSI layer to use pools.
Andreas Gunnarsson found a bug in iha that causes system crashes
when running a DIAGNOSTIC kernel. This was exposed by the recent
migration of the SCSI layer to use pools.

timeout_del() was being called on de-allocated memory after every
completed SCSI command. Which worked as long as the memory was not
reused or zapped ...

This patch, slightly modified from Andreas's original diff, moves
the timeout_del() to before the call to scsi_done() which
de-allocates the memory holding the timeout. All scb's that start
a timeout go through this logic and have the timeout_del() called.

ok millert@ deraadt@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars