[PATCHSET] libata: several fixes against libata-dev#upstream-fixes

[PATCHSET] libata: several fixes against libata-dev#upstream-fixes

[Tejun Heo]

Hello, Jeff.

This patchset contains fixes against libata-dev#upstream-fixes[1].

#01    : fix ata_port_detach() dangling SCSI host bug
#02    : fix host_set private_data init bug
#03    : fix double free of host_set->mmio_base
#04-05 : fix ata_device_add() error path

#02, #04-05 are taken from rework-host_set patchset and #01, #03 are
new.  I left rework-host_set as update to #upstream as it is too much
for .18-rcX.

This patchset is available in the following git tree.

  http://htj.dyndns.org/git/?p=libata-tj.git;a=shortlog;h=tj-upstream-fixes
  git://htj.dyndns.org/libata-tj tj-upstream-fixes

Thanks.

--
tejun

[1] f1d39b291e2263f5e2f2ec5d4061802f76d8ae67

[PATCH 1/5] libata: fix ata_port_detach() for old EH ports

[Tejun Heo]

ata_prot_detach() did nothing for old EH ports and thus SCSI hosts
associated with those ports are left dangling after they are detached
leaving stale devices and causing oops eventually.  Make
ata_port_detach() remove SCSI hosts for old EH ports.

Signed-off-by: Tejun Heo <htejun@gmail.com>

---

 drivers/scsi/libata-core.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

c3cf30a989efec8144225517e0b2f82c955e3966
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 386e5f2..bca92dd 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -5558,7 +5558,7 @@ void ata_port_detach(struct ata_port *ap
 	int i;
 
 	if (!ap->ops->error_handler)
-		return;
+		goto skip_eh;
 
 	/* tell EH we're leaving & flush EH */
 	spin_lock_irqsave(ap->lock, flags);
@@ -5594,6 +5594,7 @@ void ata_port_detach(struct ata_port *ap
 	cancel_delayed_work(&ap->hotplug_task);
 	flush_workqueue(ata_aux_wq);
 
+ skip_eh:
 	/* remove the associated SCSI host */
 	scsi_remove_host(ap->host);
 }
-- 
1.3.2

[PATCH 2/5] ata_piix: fix host_set private_data intialization

[Tejun Heo]

To get host_set->private_data initialized reliably, all pinfos need to
point to the same hpriv.  Restore pinfo->private_data after pata pinfo
assignment.

Signed-off-by: Tejun Heo <htejun@gmail.com>

---

 drivers/scsi/ata_piix.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

f814b75f4ed2ed58cd7bc876a0a9406f984aac6d
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 19745a3..298e464 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -828,6 +828,7 @@ static void __devinit piix_init_sata_map
 		case IDE:
 			WARN_ON((i & 1) || map[i + 1] != IDE);
 			pinfo[i / 2] = piix_port_info[ich5_pata];
+			pinfo[i / 2].private_data = hpriv;
 			i++;
 			printk(" IDE IDE");
 			break;
-- 
1.3.2

[PATCH 3/5] sata_sil24: don't set probe_ent->mmio_base

[Tejun Heo]

sata_sil24 doesn't make use of probe_ent->mmio_base and setting this
field causes the area to be released twice on detach.  Don't set
probe_ent->mmio_base.

Signed-off-by: Tejun Heo <htejun@gmail.com>

---

 drivers/scsi/sata_sil24.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

f31e945c50e47b7163c6018928aa93b66e8f22f0
diff --git a/drivers/scsi/sata_sil24.c b/drivers/scsi/sata_sil24.c
index 2e0f4a4..3f368c7 100644
--- a/drivers/scsi/sata_sil24.c
+++ b/drivers/scsi/sata_sil24.c
@@ -1106,7 +1106,6 @@ static int sil24_init_one(struct pci_dev
 
 	probe_ent->irq = pdev->irq;
 	probe_ent->irq_flags = IRQF_SHARED;
-	probe_ent->mmio_base = port_base;
 	probe_ent->private_data = hpriv;
 
 	hpriv->host_base = host_base;
-- 
1.3.2

[PATCH 4/5] [libata] manually inline ata_host_remove()

[Tejun Heo]

(tj: this is for the following ata_device_add() fix)

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Tejun Heo <htejun@gmail.com>

---

 drivers/scsi/libata-core.c |   31 ++++++-------------------------
 1 files changed, 6 insertions(+), 25 deletions(-)

6543bc0777fadf129d8ee7ac82e0090fb0480403
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index bca92dd..509b048 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -5185,28 +5185,6 @@ void ata_host_stop (struct ata_host_set 
 		iounmap(host_set->mmio_base);
 }
 
-
-/**
- *	ata_host_remove - Unregister SCSI host structure with upper layers
- *	@ap: Port to unregister
- *	@do_unregister: 1 if we fully unregister, 0 to just stop the port
- *
- *	LOCKING:
- *	Inherited from caller.
- */
-
-static void ata_host_remove(struct ata_port *ap, unsigned int do_unregister)
-{
-	struct Scsi_Host *sh = ap->host;
-
-	DPRINTK("ENTER\n");
-
-	if (do_unregister)
-		scsi_remove_host(sh);
-
-	ap->ops->port_stop(ap);
-}
-
 /**
  *	ata_dev_init - Initialize an ata_device structure
  *	@dev: Device structure to initialize
@@ -5532,8 +5510,11 @@ int ata_device_add(const struct ata_prob
 
 err_out:
 	for (i = 0; i < count; i++) {
-		ata_host_remove(host_set->ports[i], 1);
-		scsi_host_put(host_set->ports[i]->host);
+		struct ata_port *ap = host_set->ports[i];
+
+		scsi_remove_host(ap->host);
+		ap->ops->port_stop(ap);
+		scsi_host_put(ap->host);
 	}
 err_free_ret:
 	kfree(host_set);
@@ -5663,7 +5644,7 @@ int ata_scsi_release(struct Scsi_Host *h
 	DPRINTK("ENTER\n");
 
 	ap->ops->port_disable(ap);
-	ata_host_remove(ap, 0);
+	ap->ops->port_stop(ap);
 
 	DPRINTK("EXIT\n");
 	return 1;
-- 
1.3.2

[PATCH 5/5] libata: fix ata_device_add() error path

[Tejun Heo]

In the error path, ata_device_add()

* dereferences null host_set->ports[] element.
* calls scsi_remove_host() on not-yet-added shost.

This patch fixes both bugs.  The first problem was spotted and initial
patch submitted by Dave Jones <davej@redhat.com>.  The second problem
was mentioned and fixed by Jeff Garzik <jgarzik@pobox.com> in a larger
cleanup patch.

Cc: Dave Jones <davej@redhat.com>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Tejun Heo <htejun@gmail.com>

---

 drivers/scsi/libata-core.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

77f3f879387cc5fce6c7a4ca7777c586fe6291cd
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 509b048..16fc2dd 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -5511,10 +5511,10 @@ int ata_device_add(const struct ata_prob
 err_out:
 	for (i = 0; i < count; i++) {
 		struct ata_port *ap = host_set->ports[i];
-
-		scsi_remove_host(ap->host);
-		ap->ops->port_stop(ap);
-		scsi_host_put(ap->host);
+		if (ap) {
+			ap->ops->port_stop(ap);
+			scsi_host_put(ap->host);
+		}
 	}
 err_free_ret:
 	kfree(host_set);
-- 
1.3.2

Re: [PATCHSET] libata: several fixes against libata-dev#upstream-fixes

[Jeff Garzik]

Tejun Heo wrote:
> Hello, Jeff.
> 
> This patchset contains fixes against libata-dev#upstream-fixes[1].
> 
> #01    : fix ata_port_detach() dangling SCSI host bug
> #02    : fix host_set private_data init bug
> #03    : fix double free of host_set->mmio_base
> #04-05 : fix ata_device_add() error path
> 
> #02, #04-05 are taken from rework-host_set patchset and #01, #03 are
> new.  I left rework-host_set as update to #upstream as it is too much
> for .18-rcX.
> 
> This patchset is available in the following git tree.
> 
>   http://htj.dyndns.org/git/?p=libata-tj.git;a=shortlog;h=tj-upstream-fixes
>   git://htj.dyndns.org/libata-tj tj-upstream-fixes

pulled