Bug 212156

Summary: Problem with camperiphunit() interpretation of device hints
Product: Base System Reporter: mbrian
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: New ---    
Severity: Affects Some People    
Priority: ---    
Version: 10.0-RELEASE   
Hardware: Any   
OS: Any   

Description mbrian 2016-08-25 17:40:53 UTC
There's an issue with the way camperiphunit interprets device hints.
First, I discovered this because the cam(4) documentation lists the hint
name as:

hint.da.<n>.unit
when the code looks for:
hint.da.<n>.lun
(I've reported that separately).

However, the code in cam_periph.c (camperiphunit()) does:

        for (wired = 0; resource_find_dev(&i, dname, &dunit, NULL, NULL) == 0;
             wired = 0) {
                if (resource_string_value(dname, dunit, "at", &strval) == 0) {
                        if (strcmp(strval, pathbuf) != 0)
                                continue;
                        wired++;
                }
                if (resource_int_value(dname, dunit, "target", &val) == 0) {
                        if (val != target)
                                continue;
                        wired++;
                }
                if (resource_int_value(dname, dunit, "lun", &val) == 0) {
                        if (val != lun)
                                continue;
                        wired++;
                }
                if (wired != 0) {
                        unit = dunit;
                        break;
                }
        }

This works correctly if all three hints exist and match. However, if one of
the hints does not exist (since it has the wrong name), this code will still
match. Then net result is that with several device that differ only by lun
number, all will match the first set of hints and an attempt will be made
to assign duplicate da<n> unit numbers.

I suspect that if (wired != 0) should be if (wired ==3).