6764250 fct: ELS dequeue condition is redundantly being checked

6752001 BAD TRAP: (#pf Page fault) addr=20 occurred in module "stmf" due to a NULL pointer dereference
6750779 itadm is hung with delete-tpg
6759477 panic message: Deadlock: cycle in blocking chain

2 files changed, 21 insertions, 16 deletions

diff --git a/usr/src/uts/common/io/comstar/port/fct/discovery.c b/usr/src/uts/common/io/comstar/port/fct/discovery.c
index f594e62569..f998f44226 100644
--- a/usr/src/uts/common/io/comstar/port/fct/discovery.c
+++ b/usr/src/uts/common/io/comstar/port/fct/discovery.c
@@ -1982,7 +1982,7 @@ fct_process_els(fct_i_local_port_t *iport, fct_i_remote_port_t *irp)
 
 		if ((*ppcmd)->icmd_flags & ICMD_BEING_ABORTED) {
 			dq = 1;
-		} if (irp->irp_sa_elses_count > 1) {
+		} else if (irp->irp_sa_elses_count > 1) {
 			dq = 1;
 			/* This els might have set the CLEANUP flag */
 			atomic_and_32(&irp->irp_flags, ~IRP_SESSION_CLEANUP);
diff --git a/usr/src/uts/common/io/comstar/stmf/stmf.c b/usr/src/uts/common/io/comstar/stmf/stmf.c
index 68fc8035a8..93d602516a 100644
--- a/usr/src/uts/common/io/comstar/stmf/stmf.c
+++ b/usr/src/uts/common/io/comstar/stmf/stmf.c
@@ -4077,17 +4077,18 @@ stmf_handle_target_reset(scsi_task_t *task)
 	iss = (stmf_i_scsi_session_t *)task->task_session->ss_stmf_private;
 	ilu = (stmf_i_lu_t *)task->task_lu->lu_stmf_private;
 
-	/* Grab the session lock as a writer to prevent any changes in it */
-	rw_enter(iss->iss_lockp, RW_WRITER);
-
 	/*
 	 * To sync with LUN reset, grab this lock. The session is not going
 	 * anywhere as there is atleast one task pending (this task).
 	 */
 	mutex_enter(&stmf_state.stmf_lock);
+
+	/* Grab the session lock as a writer to prevent any changes in it */
+	rw_enter(iss->iss_lockp, RW_WRITER);
+
 	if (iss->iss_flags & ISS_RESET_ACTIVE) {
-		mutex_exit(&stmf_state.stmf_lock);
 		rw_exit(iss->iss_lockp);
+		mutex_exit(&stmf_state.stmf_lock);
 		stmf_scsilib_send_status(task, STATUS_CHECK,
 				STMF_SAA_OPERATION_IN_PROGRESS);
 		return;
@@ -4107,8 +4108,8 @@ stmf_handle_target_reset(scsi_task_t *task)
 		ilu = (stmf_i_lu_t *)(lm_ent->ent_lu->lu_stmf_private);
 		if (ilu->ilu_flags & ILU_RESET_ACTIVE) {
 			atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
-			mutex_exit(&stmf_state.stmf_lock);
 			rw_exit(iss->iss_lockp);
+			mutex_exit(&stmf_state.stmf_lock);
 			stmf_scsilib_send_status(task, STATUS_CHECK,
 					STMF_SAA_OPERATION_IN_PROGRESS);
 			return;
@@ -4117,8 +4118,8 @@ stmf_handle_target_reset(scsi_task_t *task)
 	if (lf == 0) {
 		/* No luns in this session */
 		atomic_and_32(&iss->iss_flags, ~ISS_RESET_ACTIVE);
-		mutex_exit(&stmf_state.stmf_lock);
 		rw_exit(iss->iss_lockp);
+		mutex_exit(&stmf_state.stmf_lock);
 		stmf_scsilib_send_status(task, STATUS_GOOD, 0);
 		return;
 	}
@@ -4133,8 +4134,8 @@ stmf_handle_target_reset(scsi_task_t *task)
 		ilu = (stmf_i_lu_t *)(lm_ent->ent_lu->lu_stmf_private);
 		atomic_or_32(&ilu->ilu_flags, ILU_RESET_ACTIVE);
 	}
-	mutex_exit(&stmf_state.stmf_lock);
 	rw_exit(iss->iss_lockp);
+	mutex_exit(&stmf_state.stmf_lock);
 
 	for (i = 0; i < lm->lm_nentries; i++) {
 		if (lm->lm_plus[i] == NULL)
@@ -4281,13 +4282,18 @@ stmf_worker_loop:;
 		dec_qdepth = 0;
 		if (wait_timer && (ddi_get_lbolt() >= wait_timer)) {
 			wait_timer = 0;
-			if (w->worker_task_head == NULL)
-				w->worker_task_head = w->worker_wait_head;
-			else
-				w->worker_task_tail->itask_worker_next =
-					w->worker_wait_head;
-			w->worker_task_tail = w->worker_wait_tail;
-			w->worker_wait_head = w->worker_wait_tail = NULL;
+			if (w->worker_wait_head) {
+				ASSERT(w->worker_wait_tail);
+				if (w->worker_task_head == NULL)
+					w->worker_task_head =
+					    w->worker_wait_head;
+				else
+					w->worker_task_tail->itask_worker_next =
+						w->worker_wait_head;
+				w->worker_task_tail = w->worker_wait_tail;
+				w->worker_wait_head = w->worker_wait_tail =
+				    NULL;
+			}
 		}
 		if ((itask = w->worker_task_head) == NULL) {
 			break;
@@ -4845,7 +4851,6 @@ stmf_dlun0_abort(struct stmf_lu *lu, int abort_cmd, void *arg, uint32_t flags)
 			}
 			map >>= 1;
 		}
-		itask->itask_allocated_buf_map = 0;
 	}
 	return (STMF_ABORT_SUCCESS);
 }