kernel.git/drivers/ide/ide-cd.c, branch linux-2.6.30.y

ide-cd: prevent null pointer deref via cdrom_newpc_intr

2009-07-02T23:51:05Z

commit 39c58f37a10198054c656c28202fb1e6d22fd505 upstream. With 2.6.30, the error handling code in cdrom_newpc_intr was changed to deal with partial request failures by normally completing the 'good' parts of a request and only 'error' the last (and presumably, incompletely transferred) bio associated with a particular request. In order to do this, ide_complete_rq is called over ide_cd_error_cmd() to partially complete the rq. The block layer does partial completion only for requests with bio's and if the rq doesn't have one (eg 'GPCMD_READ_DISC_INFO') the request is completed as a whole and the drive->hwif->rq pointer set to NULL afterwards. When calling ide_complete_rq again to report the error, this null pointer is derefenced, resulting in a kernel crash. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=13399. Signed-off-by: Rainer Weikusat Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman

ide-cd: fix REQ_QUIET tests in cdrom_decode_status

2009-04-30T16:24:34Z

Original patch (dfa4411cc3a690011cab90e9a536938795366cf9) was buggy. This is a more proper fix which introduces blk_rq_quiet() macro alleviating the need for dumb, too short caching variables. Thanks to Helge Deller and Bart for debugging this. Signed-off-by: Borislav Petkov Cc: Jens Axboe Cc: Sergei Shtylyov Reported-and-tested-by: Helge Deller Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: fix kernel crash on hppa regression

2009-04-22T18:33:40Z

With 2.6.30-rc2 I face a kernel crash on the 32bit hppa architecture due to ide-cd when udev creates the device nodes at startup: Kernel Fault: Code=26 regs=8ed34c40 (Addr=00000024) IASQ: 00000000 00000000 IAOQ: 1034b5ac 1034b5b0 IIR: 4ab30048 ISR: 00000000 IOR: 00000024 CPU: 0 CR30: 8ed34000 CR31: ffff55ff ORIG_R28: 00000000 IAOQ[0]: ide_complete_rq+0x2c/0x70 IAOQ[1]: ide_complete_rq+0x30/0x70 RP(r2): cdrom_newpc_intr+0x178/0x46c Backtrace: [<1035c608>] cdrom_newpc_intr+0x178/0x46c [<1034c494>] ide_intr+0x1b0/0x214 [<1016d284>] handle_IRQ_event+0x70/0x150 [<1016d4b0>] __do_IRQ+0x14c/0x1cc [<102f7864>] superio_interrupt+0x88/0xbc [<1016d284>] handle_IRQ_event+0x70/0x150 [<1016d4b0>] __do_IRQ+0x14c/0x1cc [<10112efc>] do_cpu_irq_mask+0x9c/0xd0 [<10116068>] intr_return+0x0/0x4 This crash seems to happen due to an uninitialized variable "rc". The compiler even warns about that: CC drivers/ide/ide-cd.o /mnt/sda4/home/cvs/parisc/git-kernel/linus-linux-2.6/drivers/ide/ide-cd.c: In function `cdrom_newpc_intr': /mnt/sda4/home/cvs/parisc/git-kernel/linus-linux-2.6/drivers/ide/ide-cd.c:612: warning: `rc' might be used uninitialized in this function After applying the trivial patch below, which just initializes the variable to zero, the kernel doesn't crash any longer: Starting the hotplug events dispatcher: udevd. Synthesizing the initial hotplug events... hda: command error: status=0x51 { DriveReady SeekComplete Error } hda: command error: error=0x54 <3>{ AbortedCommand LastFailedSense=0x05 } ide: failed opcode was: unknown done. Signed-off-by: Helge Deller Acked-by: Borislav Petkov Cc: Linus Cc: Kyle McMartin Cc: "Rafael J. Wysocki" Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: reverse NOT_READY sense key logic

2009-04-08T12:13:03Z

Make the case of flushing the drive's cache explicit. There should be no functional change resulting from this patch. Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: fix intendation in cdrom_decode_status()

2009-04-08T12:12:54Z

Based on earlier work by Borislav Petkov. Fix intendation in cdrom_decode_status(), no real code changes. While at it: - beautify comments There should be no functional changes caused by this patch. Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: unify handling of fs and pc requests in cdrom_decode_status()

2009-04-08T12:12:54Z

Based on earlier work by Borislav Petkov. Unify handling of fs and pc requests in cdrom_decode_status(). While at it: - remove unreachable code The only change in functionality is that for pc requests more detailed error message will be printed for following sense keys: * ILLEGAL_REQUEST * DATA_PROTECT * MEDIUM_ERROR * BLANK_CHECK Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: convert cdrom_decode_status() to use switch statements

2009-04-08T12:12:53Z

Based on earlier work by Borislav Petkov. Convert cdrom_decode_status() to use switch statements in preparation to unify handling of fs and pc requests. While at it: - remove superfluous comments and do minor CodingStyle fixups There should be no functional changes caused by this patch. Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: update debugging support

2009-04-08T12:12:53Z

Signed-off-by: Borislav Petkov [bart: extracted from "ide-cd: cleanup cdrom_decode_status" patch] Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: respect REQ_QUIET for fs requests in cdrom_decode_status()

2009-04-08T12:12:53Z

There should be no functional change resulting from this patch. Suggested-by: Bartlomiej Zolnierkiewicz Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz

ide-cd: carve out an ide_cd_breathe()-helper for fs write requests

2009-04-08T12:12:52Z

There should be no functional change resulting from this patch. Signed-off-by: Borislav Petkov Signed-off-by: Bartlomiej Zolnierkiewicz