• Bartlomiej Zolnierkiewicz's avatar
    ide: fix regression caused by ide_device_{get,put}() addition (take 2) · d3e33ff5
    Bartlomiej Zolnierkiewicz authored
    On Monday 28 July 2008, Benjamin Herrenschmidt wrote:
    > Vector: 300 (Data Access) at [c58b7b80]
    >     pc: c014f264: elv_may_queue+0x10/0x44
    >     lr: c0152750: get_request+0x2c/0x2c0
    >     sp: c58b7c30
    >    msr: 1032
    >    dar: c
    >  dsisr: 40000000
    >   current = 0xc58aaae0
    >     pid   = 854, comm = media-bay
    > enter ? for help
    > mon> t
    > [c58b7c40] c0152750 get_request+0x2c/0x2c0
    > [c58b7c70] c0152a08 get_request_wait+0x24/0xec
    > [c58b7cc0] c0225674 ide_cd_queue_pc+0x58/0x1a0
    > [c58b7d40] c022672c ide_cdrom_packet+0x9c/0xdc
    > [c58b7d70] c0261810 cdrom_get_disc_info+0x60/0xd0
    > [c58b7dc0] c026208c cdrom_mrw_exit+0x1c/0x11c
    > [c58b7e30] c0260f7c unregister_cdrom+0x84/0xe8
    > [c58b7e50] c022395c ide_cd_release+0x80/0x84
    > [c58b7e70] c0163650 kref_put+0x54/0x6c
    > [c58b7e80] c0223884 ide_cd_put+0x40/0x5c
    > [c58b7ea0] c0211100 generic_ide_remove+0x28/0x3c
    > [c58b7eb0] c01e9d34 __device_release_driver+0x78/0xb4
    > [c58b7ec0] c01e9e44 device_release_driver+0x28/0x44
    > [c58b7ee0] c01e8f7c bus_remove_device+0xac/0xd8
    > [c58b7f00] c01e7424 device_del+0x104/0x198
    > [c58b7f20] c01e74d0 device_unregister+0x18/0x30
    > [c58b7f40] c02121c4 __ide_port_unregister_devices+0x6c/0x88
    > [c58b7f60] c0212398 ide_port_unregister_devices+0x38/0x80
    > [c58b7f80] c0208ca4 media_bay_step+0x1cc/0x5c0
    > [c58b7fb0] c0209124 media_bay_task+0x8c/0xcc
    > [c58b7fd0] c00485c0 kthread+0x48/0x84
    > [c58b7ff0] c0011b20 kernel_thread+0x44/0x60
    The guilty commit turned out to be 08da591e
    ("ide: add ide_device_{get,put}() helpers").  ide_device_put() is called
    before kref_put() in ide_cd_put() so IDE device is already gone by the time
    ide_cd_release() is reached.
    Fix it by calling ide_device_get() before kref_get() and ide_device_put()
    after kref_put() in all affected device drivers.
    Brown paper bag time.  In v1 cd->drive was referenced after dropping last
    reference on cd object (which could result in OOPS in ide_device_put() as
    reported/debugged by Mariusz Kozlowski).  Fix it by caching cd->drive in
    the local variable (fix other device drivers too).
    Reported-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
    Reported-by: default avatarMariusz Kozlowski <m.kozlowski@tuxland.pl>
    Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Cc: Borislav Petkov <petkovbb@gmail.com>
    Tested-by: default avatarMariusz Kozlowski <m.kozlowski@tuxland.pl>
    Tested-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: default avatarBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
ide-tape.c 75.1 KB