Skip to contentSkip to conversation

2.4.32 Don't panic on IDE DMA errors

PATCH Applied Chris Ross 2 participants 2 messages Nov 23, 2005 – Nov 28, 2005

lore
Share & tools
lore

Chris Ross

author
#0 lore raw

PATCH 1/1 2.4.32 Don't panic on IDE DMA errors

Kernel 2.4.32 and earlier can panic when trying to read a corrupted sector from an IDE disk.

The function ide_dma_timeout_retry can end a request early by calling idedisk_error, but then goes on to use the request anyway causing a kernel panic due to a null pointer exception. This patch fixes that.

Regards,
Chris R.

drivers/ide/ide-io.c +7 -5
diff -urN -X dontdiff linux-2.4.32/drivers/ide/ide-io.c patched-linux-2.4.32/drivers/ide/ide-io.c
@@ -899,11 +899,13 @@
 	rq = HWGROUP(drive)->rq;
 	HWGROUP(drive)->rq = NULL;
 
-	rq->errors = 0;
-	rq->sector = rq->bh->b_rsector;
-	rq->current_nr_sectors = rq->bh->b_size >> 9;
-	rq->hard_cur_sectors = rq->current_nr_sectors;
-	rq->buffer = rq->bh->b_data;
+	if (rq) {
+		rq->errors = 0;
+		rq->sector = rq->bh->b_rsector;
+		rq->current_nr_sectors = rq->bh->b_size >> 9;
+		rq->hard_cur_sectors = rq->current_nr_sectors;
+		rq->buffer = rq->bh->b_data;
+	}
 
 	return ret;
 }
#1 lore raw

Applied, thanks Chris.

Quoted 35 lines · Chris Ross

Kernel 2.4.32 and earlier can panic when trying to read a corrupted sector from an IDE disk.

The function ide_dma_timeout_retry can end a request early by calling idedisk_error, but then goes on to use the request anyway causing a kernel panic due to a null pointer exception. This patch fixes that.

Regards,
Chris R.

diff -urN -X dontdiff linux-2.4.32/drivers/ide/ide-io.c patched-linux-2.4.32/drivers/ide/ide-io.c

drivers/ide/ide-io.c +0 -0

12:33:37.000000000 +0000

drivers/ide/ide-io.c +7 -5
@@ -899,11 +899,13 @@
 	rq = HWGROUP(drive)->rq;
 	HWGROUP(drive)->rq = NULL;
 
-	rq->errors = 0;
-	rq->sector = rq->bh->b_rsector;
-	rq->current_nr_sectors = rq->bh->b_size >> 9;
-	rq->hard_cur_sectors = rq->current_nr_sectors;
-	rq->buffer = rq->bh->b_data;
+	if (rq) {
+		rq->errors = 0;
+		rq->sector = rq->bh->b_rsector;
+		rq->current_nr_sectors = rq->bh->b_size >> 9;
+		rq->hard_cur_sectors = rq->current_nr_sectors;
+		rq->buffer = rq->bh->b_data;
+	}
 
 	return ret;
 }