IDE: Fix HDIO_DRIVE_RESET handling

Currently, the code path executing an HDIO_DRIVE_RESET ioctl is broken
in various ways.  Most importantly, it is treated as an out of band
request in an illegal way which may very likely lead to system lock ups.
Use the drive's request queue to avoid this problem (and fix a locking
issue for free along the way).

Signed-off-by: Elias Oltmanns <eo@nebensachen.de>
Cc: "Alan Cox" <alan@lxorguk.ukuu.org.uk>
Cc: "Randy Dunlap" <randy.dunlap@oracle.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

1 files changed, 22 insertions, 1 deletions

diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 28057747c1f8..2b33c129740b 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -766,6 +766,18 @@ static ide_startstop_t execute_drive_cmd (ide_drive_t *drive,
         return ide_stopped;
 }
 
+static ide_startstop_t ide_special_rq(ide_drive_t *drive, struct request *rq)
+{
+        switch (rq->cmd[0]) {
+        case REQ_DRIVE_RESET:
+                return ide_do_reset(drive);
+        default:
+                blk_dump_rq_flags(rq, "ide_special_rq - bad request");
+                ide_end_request(drive, 0, 0);
+                return ide_stopped;
+        }
+}
+
 static void ide_check_pm_state(ide_drive_t *drive, struct request *rq)
 {
         struct request_pm_state *pm = rq->data;
@@ -869,7 +881,16 @@ static ide_startstop_t start_request (ide_drive_t *drive, struct request *rq)
                             pm->pm_step == ide_pm_state_completed)
                                 ide_complete_pm_request(drive, rq);
                         return startstop;
-                }
+                } else if (!rq->rq_disk && blk_special_request(rq))
+                        /*
+                         * TODO: Once all ULDs have been modified to
+                         * check for specific op codes rather than
+                         * blindly accepting any special request, the
+                         * check for ->rq_disk above may be replaced
+                         * by a more suitable mechanism or even
+                         * dropped entirely.
+                         */
+                        return ide_special_rq(drive, rq);
 
                 drv = *(ide_driver_t **)rq->rq_disk->private_data;
                 return drv->do_request(drive, rq, block);