[PATCH] IDE error handling fixes

In 2.6.15.1 I encountered some IDE crashes when unplugging IDE cables to
emulate disk errors.  Below is a patch against 2.6.16 which I think still
applies.

1.  The first BUG_ON could trigger when a PREFLUSH IO fails (it would
   fail the original barrier request which hasn't been marked REQ_STARTED
   yet).

2. the rq could have been dequeued already (same as 1).

3.  HWGROUP(drive)->rq could be NULL because of the ide_error() several
   lines earlier.

Signed-off-by: Hua Zhong <hzhong@gmail.com>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 38479a29d3e..8d26619ba16 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -59,8 +59,6 @@ static int __ide_end_request(ide_drive_t *drive, struct request *rq,
 {
         int ret = 1;
 
-        BUG_ON(!blk_rq_started(rq));
-
         /*
          * if failfast is set on a request, override number of sectors and
          * complete the whole request right now
@@ -82,7 +80,8 @@ static int __ide_end_request(ide_drive_t *drive, struct request *rq,
 
         if (!end_that_request_first(rq, uptodate, nr_sectors)) {
                 add_disk_randomness(rq->rq_disk);
-                blkdev_dequeue_request(rq);
+                if (!list_empty(&rq->queuelist))
+                        blkdev_dequeue_request(rq);
                 HWGROUP(drive)->rq = NULL;
                 end_that_request_last(rq, uptodate);
                 ret = 0;
@@ -1346,6 +1345,10 @@ static ide_startstop_t ide_dma_timeout_retry(ide_drive_t *drive, int error)
          * make sure request is sane
          */
         rq = HWGROUP(drive)->rq;
+
+        if (!rq)
+                goto out;
+
         HWGROUP(drive)->rq = NULL;
 
         rq->errors = 0;