aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/ide
diff options
context:
space:
mode:
authorBartlomiej Zolnierkiewicz <bzolnier@gmail.com>2008-08-05 12:16:59 -0400
committerBartlomiej Zolnierkiewicz <bzolnier@gmail.com>2008-08-05 12:16:59 -0400
commitd3e33ff59facec005e48ba3360502b73a04e4b4e (patch)
tree7f5b6354d5d6794b35a5ea2bcee33ea16d8e326c /drivers/ide
parentb5b9309d3415480b3e66314a1d6c89db58bff9de (diff)
ide: fix regression caused by ide_device_{get,put}() addition (take 2)
On Monday 28 July 2008, Benjamin Herrenschmidt wrote: [...] > Vector: 300 (Data Access) at [c58b7b80] > pc: c014f264: elv_may_queue+0x10/0x44 > lr: c0152750: get_request+0x2c/0x2c0 > sp: c58b7c30 > msr: 1032 > dar: c > dsisr: 40000000 > current = 0xc58aaae0 > pid = 854, comm = media-bay > enter ? for help > mon> t > [c58b7c40] c0152750 get_request+0x2c/0x2c0 > [c58b7c70] c0152a08 get_request_wait+0x24/0xec > [c58b7cc0] c0225674 ide_cd_queue_pc+0x58/0x1a0 > [c58b7d40] c022672c ide_cdrom_packet+0x9c/0xdc > [c58b7d70] c0261810 cdrom_get_disc_info+0x60/0xd0 > [c58b7dc0] c026208c cdrom_mrw_exit+0x1c/0x11c > [c58b7e30] c0260f7c unregister_cdrom+0x84/0xe8 > [c58b7e50] c022395c ide_cd_release+0x80/0x84 > [c58b7e70] c0163650 kref_put+0x54/0x6c > [c58b7e80] c0223884 ide_cd_put+0x40/0x5c > [c58b7ea0] c0211100 generic_ide_remove+0x28/0x3c > [c58b7eb0] c01e9d34 __device_release_driver+0x78/0xb4 > [c58b7ec0] c01e9e44 device_release_driver+0x28/0x44 > [c58b7ee0] c01e8f7c bus_remove_device+0xac/0xd8 > [c58b7f00] c01e7424 device_del+0x104/0x198 > [c58b7f20] c01e74d0 device_unregister+0x18/0x30 > [c58b7f40] c02121c4 __ide_port_unregister_devices+0x6c/0x88 > [c58b7f60] c0212398 ide_port_unregister_devices+0x38/0x80 > [c58b7f80] c0208ca4 media_bay_step+0x1cc/0x5c0 > [c58b7fb0] c0209124 media_bay_task+0x8c/0xcc > [c58b7fd0] c00485c0 kthread+0x48/0x84 > [c58b7ff0] c0011b20 kernel_thread+0x44/0x60 The guilty commit turned out to be 08da591e14cf87247ec09b17c350235157a92fc3 ("ide: add ide_device_{get,put}() helpers"). ide_device_put() is called before kref_put() in ide_cd_put() so IDE device is already gone by the time ide_cd_release() is reached. Fix it by calling ide_device_get() before kref_get() and ide_device_put() after kref_put() in all affected device drivers. v2: Brown paper bag time. In v1 cd->drive was referenced after dropping last reference on cd object (which could result in OOPS in ide_device_put() as reported/debugged by Mariusz Kozlowski). Fix it by caching cd->drive in the local variable (fix other device drivers too). Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Reported-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Borislav Petkov <petkovbb@gmail.com> Tested-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Diffstat (limited to 'drivers/ide')
-rw-r--r--drivers/ide/ide-cd.c12
-rw-r--r--drivers/ide/ide-disk.c11
-rw-r--r--drivers/ide/ide-floppy.c11
-rw-r--r--drivers/ide/ide-tape.c11
4 files changed, 25 insertions, 20 deletions
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index e617cf08aef6..e19caa1453a3 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -66,11 +66,11 @@ static struct cdrom_info *ide_cd_get(struct gendisk *disk)
66 mutex_lock(&idecd_ref_mutex); 66 mutex_lock(&idecd_ref_mutex);
67 cd = ide_cd_g(disk); 67 cd = ide_cd_g(disk);
68 if (cd) { 68 if (cd) {
69 kref_get(&cd->kref); 69 if (ide_device_get(cd->drive))
70 if (ide_device_get(cd->drive)) {
71 kref_put(&cd->kref, ide_cd_release);
72 cd = NULL; 70 cd = NULL;
73 } 71 else
72 kref_get(&cd->kref);
73
74 } 74 }
75 mutex_unlock(&idecd_ref_mutex); 75 mutex_unlock(&idecd_ref_mutex);
76 return cd; 76 return cd;
@@ -78,9 +78,11 @@ static struct cdrom_info *ide_cd_get(struct gendisk *disk)
78 78
79static void ide_cd_put(struct cdrom_info *cd) 79static void ide_cd_put(struct cdrom_info *cd)
80{ 80{
81 ide_drive_t *drive = cd->drive;
82
81 mutex_lock(&idecd_ref_mutex); 83 mutex_lock(&idecd_ref_mutex);
82 ide_device_put(cd->drive);
83 kref_put(&cd->kref, ide_cd_release); 84 kref_put(&cd->kref, ide_cd_release);
85 ide_device_put(drive);
84 mutex_unlock(&idecd_ref_mutex); 86 mutex_unlock(&idecd_ref_mutex);
85} 87}
86 88
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 28d85b410f7c..68b9cf0138b0 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -65,11 +65,10 @@ static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
65 mutex_lock(&idedisk_ref_mutex); 65 mutex_lock(&idedisk_ref_mutex);
66 idkp = ide_disk_g(disk); 66 idkp = ide_disk_g(disk);
67 if (idkp) { 67 if (idkp) {
68 kref_get(&idkp->kref); 68 if (ide_device_get(idkp->drive))
69 if (ide_device_get(idkp->drive)) {
70 kref_put(&idkp->kref, ide_disk_release);
71 idkp = NULL; 69 idkp = NULL;
72 } 70 else
71 kref_get(&idkp->kref);
73 } 72 }
74 mutex_unlock(&idedisk_ref_mutex); 73 mutex_unlock(&idedisk_ref_mutex);
75 return idkp; 74 return idkp;
@@ -77,9 +76,11 @@ static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
77 76
78static void ide_disk_put(struct ide_disk_obj *idkp) 77static void ide_disk_put(struct ide_disk_obj *idkp)
79{ 78{
79 ide_drive_t *drive = idkp->drive;
80
80 mutex_lock(&idedisk_ref_mutex); 81 mutex_lock(&idedisk_ref_mutex);
81 ide_device_put(idkp->drive);
82 kref_put(&idkp->kref, ide_disk_release); 82 kref_put(&idkp->kref, ide_disk_release);
83 ide_device_put(drive);
83 mutex_unlock(&idedisk_ref_mutex); 84 mutex_unlock(&idedisk_ref_mutex);
84} 85}
85 86
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index ca11a26746f1..e9034c0125f3 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -167,11 +167,10 @@ static struct ide_floppy_obj *ide_floppy_get(struct gendisk *disk)
167 mutex_lock(&idefloppy_ref_mutex); 167 mutex_lock(&idefloppy_ref_mutex);
168 floppy = ide_floppy_g(disk); 168 floppy = ide_floppy_g(disk);
169 if (floppy) { 169 if (floppy) {
170 kref_get(&floppy->kref); 170 if (ide_device_get(floppy->drive))
171 if (ide_device_get(floppy->drive)) {
172 kref_put(&floppy->kref, idefloppy_cleanup_obj);
173 floppy = NULL; 171 floppy = NULL;
174 } 172 else
173 kref_get(&floppy->kref);
175 } 174 }
176 mutex_unlock(&idefloppy_ref_mutex); 175 mutex_unlock(&idefloppy_ref_mutex);
177 return floppy; 176 return floppy;
@@ -179,9 +178,11 @@ static struct ide_floppy_obj *ide_floppy_get(struct gendisk *disk)
179 178
180static void ide_floppy_put(struct ide_floppy_obj *floppy) 179static void ide_floppy_put(struct ide_floppy_obj *floppy)
181{ 180{
181 ide_drive_t *drive = floppy->drive;
182
182 mutex_lock(&idefloppy_ref_mutex); 183 mutex_lock(&idefloppy_ref_mutex);
183 ide_device_put(floppy->drive);
184 kref_put(&floppy->kref, idefloppy_cleanup_obj); 184 kref_put(&floppy->kref, idefloppy_cleanup_obj);
185 ide_device_put(drive);
185 mutex_unlock(&idefloppy_ref_mutex); 186 mutex_unlock(&idefloppy_ref_mutex);
186} 187}
187 188
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 82c2afe4d28a..1bce84b56630 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -331,11 +331,10 @@ static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
331 mutex_lock(&idetape_ref_mutex); 331 mutex_lock(&idetape_ref_mutex);
332 tape = ide_tape_g(disk); 332 tape = ide_tape_g(disk);
333 if (tape) { 333 if (tape) {
334 kref_get(&tape->kref); 334 if (ide_device_get(tape->drive))
335 if (ide_device_get(tape->drive)) {
336 kref_put(&tape->kref, ide_tape_release);
337 tape = NULL; 335 tape = NULL;
338 } 336 else
337 kref_get(&tape->kref);
339 } 338 }
340 mutex_unlock(&idetape_ref_mutex); 339 mutex_unlock(&idetape_ref_mutex);
341 return tape; 340 return tape;
@@ -343,9 +342,11 @@ static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
343 342
344static void ide_tape_put(struct ide_tape_obj *tape) 343static void ide_tape_put(struct ide_tape_obj *tape)
345{ 344{
345 ide_drive_t *drive = tape->drive;
346
346 mutex_lock(&idetape_ref_mutex); 347 mutex_lock(&idetape_ref_mutex);
347 ide_device_put(tape->drive);
348 kref_put(&tape->kref, ide_tape_release); 348 kref_put(&tape->kref, ide_tape_release);
349 ide_device_put(drive);
349 mutex_unlock(&idetape_ref_mutex); 350 mutex_unlock(&idetape_ref_mutex);
350} 351}
351 352