Re: Crash in ide_do_request() on card removal

[Steven Scholz <steven.scholz@imc-berlin.de>]

Jens Axboe wrote:

> On Tue, Aug 02 2005, Steven Scholz wrote:
> 
>>Jens Axboe wrote:
>>
>>
>>>That's not quite true, q is not invalid after this call. It will only be
>>>invalid when it is freed (which doesn't happen from here but rather from
>>>the blk_cleanup_queue() call when the reference count drops to 0).
>>>
>>>This is still not perfect, but a lot better. Does it work for you?
>>>
>>>--- linux-2.6.12/drivers/ide/ide-disk.c~	2005-08-02 
>>>12:48:16.000000000 +0200
>>>+++ linux-2.6.12/drivers/ide/ide-disk.c	2005-08-02 
>>>12:48:32.000000000 +0200
>>>@@ -1054,6 +1054,7 @@
>>>	drive->driver_data = NULL;
>>>	drive->devfs_name[0] = '\0';
>>>	g->private_data = NULL;
>>>+	g->disk = NULL;
>>>	put_disk(g);
>>>	kfree(idkp);
>>>}
>>
>>No.
>>drivers/ide/ide-disk.c: In function `ide_disk_release':
>>drivers/ide/ide-disk.c:1057: error: structure has no member named `disk'
> 
> 
> Eh, typo, should be g->queue of course :-)
> 
> --- linux-2.6.12/drivers/ide/ide-disk.c~	2005-08-02 12:48:16.000000000 +0200
> +++ linux-2.6.12/drivers/ide/ide-disk.c	2005-08-02 13:12:54.000000000 +0200
> @@ -1054,6 +1054,7 @@
>  	drive->driver_data = NULL;
>  	drive->devfs_name[0] = '\0';
>  	g->private_data = NULL;
> +	g->queue = NULL;
>  	put_disk(g);
>  	kfree(idkp);
>  }

No. That does not work:

~ # umount /mnt/pcmcia/
generic_make_request(2859) q=c02d3040
__generic_unplug_device(1447) calling q->request_fn() @ c00f97ec

do_ide_request(1281) HWIF=c01dee8c (0), HWGROUP=c089cea0 (1038681856), 
drive=c01def1c (0, 0), queue=c02d3040 (00000000)
do_ide_request(1287) HWIF is not present anymore!!!
do_ide_request(1291) DRIVE is not present anymore. SKIPPING REQUEST!!!

As you can see generic_make_request() still has the pointer to that queue!
It gets it with

	q = bdev_get_queue(bio->bi_bdev);

So the pointer is still stored soemwhere else...

-- 
Steven