2 files changed, 19 insertions, 3 deletions

diff --git a/sys/dev/isp/isp_freebsd.c b/sys/dev/isp/isp_freebsd.c
index d5aa7a54142e..b496eae1b466 100644
--- a/sys/dev/isp/isp_freebsd.c
+++ b/sys/dev/isp/isp_freebsd.c
@@ -987,6 +987,16 @@ isp_target_start_ctio(ispsoftc_t *isp, union ccb *ccb, enum Start_Ctio_How how)
 		}
 
 		/*
+		 * Is this command a dead duck?
+		 */
+		if (atp->dead) {
+			isp_prt(isp, ISP_LOGERR, "%s: [0x%x] not sending a CTIO for a dead command", __func__, cso->tag_id);
+			ccb->ccb_h.status = CAM_REQ_ABORTED;
+			xpt_done(ccb);
+			continue;
+		}
+
+		/*
 		 * Check to make sure we're still in target mode.
 		 */
 		fcp = FCPARAM(isp, XS_CHANNEL(ccb));
@@ -2503,14 +2513,19 @@ isp_action(struct cam_sim *sim, union ccb *ccb)
 		}
 
 		/*
-		 * Target should abort all affected CCBs before ACK-ing INOT,
+		 * Target should abort all affected tasks before ACK-ing INOT,
 		 * but if/since it doesn't, add this hack to allow tag reuse.
+		 * We can not do it if some CTIOs are in progress, or we won't
+		 * handle the completions.  In such case just block new ones.
 		 */
 		uint32_t rsp = (ccb->ccb_h.flags & CAM_SEND_STATUS) ? ccb->cna2.arg : 0;
 		if (ntp->nt.nt_ncode == NT_ABORT_TASK && (rsp & 0xff) == 0 &&
 		    (atp = isp_find_atpd(isp, XS_CHANNEL(ccb), ccb->cna2.seq_id)) != NULL) {
-			if (isp_abort_atpd(isp, XS_CHANNEL(ccb), atp) == 0)
+			if (atp->ctcnt == 0 &&
+			    isp_abort_atpd(isp, XS_CHANNEL(ccb), atp) == 0)
 				isp_put_atpd(isp, XS_CHANNEL(ccb), atp);
+			else
+				atp->dead = 1;
 		}
 
 		if (isp_handle_platform_target_notify_ack(isp, &ntp->nt, rsp)) {
diff --git a/sys/dev/isp/isp_freebsd.h b/sys/dev/isp/isp_freebsd.h
index 5bb3dd43b6de..73390fa14769 100644
--- a/sys/dev/isp/isp_freebsd.h
+++ b/sys/dev/isp/isp_freebsd.h
@@ -104,8 +104,9 @@ typedef struct atio_private_data {
 	uint16_t	ctcnt;	/* number of CTIOs currently active */
 	uint8_t		seqno;	/* CTIO sequence number */
 	uint8_t		cdb0;
-	uint8_t		srr_notify_rcvd	: 1,
+	uint16_t	srr_notify_rcvd	: 1,
 			sendst		: 1,
+			dead		: 1,
 			tattr		: 3,
 			state		: 3;
 	void *		ests;