Re: Crash in ide_do_request() on card removal

[Jens Axboe <axboe@suse.de>]

On Tue, Aug 02 2005, Steven Scholz wrote:
> Jens Axboe wrote:
> 
> >On Tue, Aug 02 2005, Steven Scholz wrote:
> >
> >>Jens Axboe wrote:
> >>
> >>
> >>>That's not quite true, q is not invalid after this call. It will only be
> >>>invalid when it is freed (which doesn't happen from here but rather from
> >>>the blk_cleanup_queue() call when the reference count drops to 0).
> >>>
> >>>This is still not perfect, but a lot better. Does it work for you?
> >>>
> >>>--- linux-2.6.12/drivers/ide/ide-disk.c~	2005-08-02 
> >>>12:48:16.000000000 +0200
> >>>+++ linux-2.6.12/drivers/ide/ide-disk.c	2005-08-02 
> >>>12:48:32.000000000 +0200
> >>>@@ -1054,6 +1054,7 @@
> >>>	drive->driver_data = NULL;
> >>>	drive->devfs_name[0] = '\0';
> >>>	g->private_data = NULL;
> >>>+	g->disk = NULL;
> >>>	put_disk(g);
> >>>	kfree(idkp);
> >>>}
> >>
> >>No.
> >>drivers/ide/ide-disk.c: In function `ide_disk_release':
> >>drivers/ide/ide-disk.c:1057: error: structure has no member named `disk'
> >
> >
> >Eh, typo, should be g->queue of course :-)
> >
> >--- linux-2.6.12/drivers/ide/ide-disk.c~	2005-08-02 
> >12:48:16.000000000 +0200
> >+++ linux-2.6.12/drivers/ide/ide-disk.c	2005-08-02 
> >13:12:54.000000000 +0200
> >@@ -1054,6 +1054,7 @@
> > 	drive->driver_data = NULL;
> > 	drive->devfs_name[0] = '\0';
> > 	g->private_data = NULL;
> >+	g->queue = NULL;
> > 	put_disk(g);
> > 	kfree(idkp);
> > }
> 
> No. That does not work:
> 
> ~ # umount /mnt/pcmcia/
> generic_make_request(2859) q=c02d3040
> __generic_unplug_device(1447) calling q->request_fn() @ c00f97ec
> 
> do_ide_request(1281) HWIF=c01dee8c (0), HWGROUP=c089cea0 (1038681856), 
> drive=c01def1c (0, 0), queue=c02d3040 (00000000)
> do_ide_request(1287) HWIF is not present anymore!!!
> do_ide_request(1291) DRIVE is not present anymore. SKIPPING REQUEST!!!
> 
> As you can see generic_make_request() still has the pointer to that queue!
> It gets it with
> 
> 	q = bdev_get_queue(bio->bi_bdev);
> 
> So the pointer is still stored soemwhere else...

Hmmm, perhaps just let ide end requests where the drive has been
removed might be better. The disconnection between the queue cleanup and
the gendisk cleanup makes it harder to do it properly. SCSI deals with
it the same way, basically.

-- 
Jens Axboe