ide-disk: fix flush requests (take 2)

commit 813a0eb233ee67d7166241a8b389b6a76f2247f9
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Fri Jan 25 22:17:10 2008 +0100

    ide: switch idedisk_prepare_flush() to use REQ_TYPE_ATA_TASKFILE requests

...

broke flush requests.

Allocating IDE command structure on the stack for flush requests is not
a very brilliant idea:

- idedisk_prepare_flush() only prepares the request and it doesn't wait
  for it to be completed

- there are can be multiple flush requests queued in the queue

Fix the problem (per hints from James Bottomley) by:
- dynamically allocating ide_task_t instance using kmalloc(..., GFP_ATOMIC)
- adding new taskfile flag (IDE_TFLAG_DYN)
- calling kfree() in ide_end_drive_command() if IDE_TFLAG_DYN is set
  (while at it rename 'args' to 'task' and fix whitespace damage)

[ This will be fixed properly before 2.6.25 but this bug is rather
  critical and the proper solution requires some more work + testing. ]

Thanks to Sebastian Siewior and Christoph Hellwig for reporting the
problem and testing patches (extra thanks to Sebastian for bisecting
it to the guilty commmit).

Tested-by: Sebastian Siewior <ide-bug@ml.breakpoint.cc>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Tejun Heo <htejun@gmail.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

1 files changed, 10 insertions, 6 deletions

diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index e41383fa3a51..715379605a7b 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -361,17 +361,21 @@ void ide_end_drive_cmd (ide_drive_t *drive, u8 stat, u8 err)
         spin_unlock_irqrestore(&ide_lock, flags);
 
         if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
-                ide_task_t *args = (ide_task_t *) rq->special;
+                ide_task_t *task = (ide_task_t *)rq->special;
+
                 if (rq->errors == 0)
-                        rq->errors = !OK_STAT(stat,READY_STAT,BAD_STAT);
-                        
-                if (args) {
-                        struct ide_taskfile *tf = &args->tf;
+                        rq->errors = !OK_STAT(stat, READY_STAT, BAD_STAT);
+
+                if (task) {
+                        struct ide_taskfile *tf = &task->tf;
 
                         tf->error = err;
                         tf->status = stat;
 
-                        ide_tf_read(drive, args);
+                        ide_tf_read(drive, task);
+
+                        if (task->tf_flags & IDE_TFLAG_DYN)
+                                kfree(task);
                 }
         } else if (blk_pm_request(rq)) {
                 struct request_pm_state *pm = rq->data;