Re: 2.4.19: oops in ide-scsi

James Stevenson
2002-09-24T21:40:26Z

On Tue, 2002-09-24 at 22:00, Philippe Troin wrote:
> James Stevenson <james@stev.org> writes:
>
> > Hi
> >
> > i am glad somebody else sees the same crash as me the
> > request Q gets set to NULL for some reson then tries to
> > increment a stats counter in the null pointer.
> > i know what the bug is i just dont know how to fix it :>
>
> I'm not sure which Q you're talking about.
> Is that rq (in idescsi_pc_intr())?

the crash happens on

if (status & ERR_STAT)
rq->errors++;

because
struct request *rq = pc->rq;
is NULL

from ide-scsi.c

static ide_startstop_t idescsi_pc_intr (ide_drive_t *drive)
{
idescsi_scsi_t *scsi = drive->driver_data;
byte status, ireason;
int bcount;
idescsi_pc_t *pc=scsi->pc;
struct request *rq = pc->rq;
unsigned int temp;

// SNIPED some code

if ((status & DRQ_STAT) == 0) { /* No more interrupts */
if (test_bit(IDESCSI_LOG_CMD, &scsi->log))
printk (KERN_INFO "Packet command completed, %d bytes transferred\n",
pc->actually_transferred);
ide__sti();
if (status & ERR_STAT)
rq->errors++;
idescsi_end_request (1, HWGROUP(drive));
return ide_stopped;
}
bcount = IN_BYTE (IDE_BCOUNT