NULL pointer dereference in ide_drive_remove.

NULL pointer dereference in ide_drive_remove.

[Steven Scholz]

Hi there,

(This is my first post to this list! Bear with me.)

I am working on PCMCIA IDE on an embedded ARM board (2.6.12-rc4).

After doing

~ # umount /mnt/pcmcia
~ # cardctl eject

the board crashes with

Unable to handle kernel NULL pointer dereference at virtual address 00000010
pgd = c08e8000
[00000010] *pgd=208ef031, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1]
Modules linked in:
CPU: 0
PC is at ide_drive_remove+0x44/0x64
LR is at ide_drive_remove+0x48/0x64
...
Process cardctl (pid: 773, stack limit = 0xc0d54194)
...
Backtrace:
(ide_drive_remove+0x0/0x64) from (device_release_driver+0x70/0x80)
(device_release_driver+0x0/0x80) from (bus_remove_device+0x58/0x90)
(bus_remove_device+0x0/0x90) from (device_del+0x68/0x9c)

I added a few debug outputs and noticed that the call stack is

IDE: ide_unregister(639)
IDE: ide_unregister_subdriver(2094)
IDE: ide_unregister_subdriver(2096): drive=hda, driver=ide-disk
IDE: auto_remove_settings(1092)
IDE: ide_hwif_release_regions(494)
IDE: ide_drive_remove(2127)
IDE: ide_drive_remove(2133): ERROR: DRIVER(drive)=00000000 !!!

In ide_unregister_subdriver() I found

	drive->driver = NULL;

so of corse if ide_drive_remove() is called later DRIVER(drive) is NULL and 
DRIVER(drive)->cleanup(drive) crashes.

So maybe you want to do a check like

	if (DRIVER(drive))
		DRIVER(drive)->cleanup(drive);

in drivers/ide/ide.c:ide_drive_remove().

Please CC me as I am not subscribe to the list.

-- 
Steven