Revision d3e33ff59facec005e48ba3360502b73a04e4b4e authored by Bartlomiej Zolnierkiewicz on 05 August 2008, 16:16:59 UTC, committed by Bartlomiej Zolnierkiewicz on 05 August 2008, 16:16:59 UTC
On Monday 28 July 2008, Benjamin Herrenschmidt wrote: [...] > Vector: 300 (Data Access) at [c58b7b80] > pc: c014f264: elv_may_queue+0x10/0x44 > lr: c0152750: get_request+0x2c/0x2c0 > sp: c58b7c30 > msr: 1032 > dar: c > dsisr: 40000000 > current = 0xc58aaae0 > pid = 854, comm = media-bay > enter ? for help > mon> t > [c58b7c40] c0152750 get_request+0x2c/0x2c0 > [c58b7c70] c0152a08 get_request_wait+0x24/0xec > [c58b7cc0] c0225674 ide_cd_queue_pc+0x58/0x1a0 > [c58b7d40] c022672c ide_cdrom_packet+0x9c/0xdc > [c58b7d70] c0261810 cdrom_get_disc_info+0x60/0xd0 > [c58b7dc0] c026208c cdrom_mrw_exit+0x1c/0x11c > [c58b7e30] c0260f7c unregister_cdrom+0x84/0xe8 > [c58b7e50] c022395c ide_cd_release+0x80/0x84 > [c58b7e70] c0163650 kref_put+0x54/0x6c > [c58b7e80] c0223884 ide_cd_put+0x40/0x5c > [c58b7ea0] c0211100 generic_ide_remove+0x28/0x3c > [c58b7eb0] c01e9d34 __device_release_driver+0x78/0xb4 > [c58b7ec0] c01e9e44 device_release_driver+0x28/0x44 > [c58b7ee0] c01e8f7c bus_remove_device+0xac/0xd8 > [c58b7f00] c01e7424 device_del+0x104/0x198 > [c58b7f20] c01e74d0 device_unregister+0x18/0x30 > [c58b7f40] c02121c4 __ide_port_unregister_devices+0x6c/0x88 > [c58b7f60] c0212398 ide_port_unregister_devices+0x38/0x80 > [c58b7f80] c0208ca4 media_bay_step+0x1cc/0x5c0 > [c58b7fb0] c0209124 media_bay_task+0x8c/0xcc > [c58b7fd0] c00485c0 kthread+0x48/0x84 > [c58b7ff0] c0011b20 kernel_thread+0x44/0x60 The guilty commit turned out to be 08da591e14cf87247ec09b17c350235157a92fc3 ("ide: add ide_device_{get,put}() helpers"). ide_device_put() is called before kref_put() in ide_cd_put() so IDE device is already gone by the time ide_cd_release() is reached. Fix it by calling ide_device_get() before kref_get() and ide_device_put() after kref_put() in all affected device drivers. v2: Brown paper bag time. In v1 cd->drive was referenced after dropping last reference on cd object (which could result in OOPS in ide_device_put() as reported/debugged by Mariusz Kozlowski). Fix it by caching cd->drive in the local variable (fix other device drivers too). Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Reported-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Borislav Petkov <petkovbb@gmail.com> Tested-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
1 parent b5b9309
File | Mode | Size |
---|---|---|
lzo | ||
reed_solomon | ||
zlib_deflate | ||
zlib_inflate | ||
.gitignore | -rw-r--r-- | 51 bytes |
Kconfig | -rw-r--r-- | 3.1 KB |
Kconfig.debug | -rw-r--r-- | 25.5 KB |
Kconfig.kgdb | -rw-r--r-- | 1.8 KB |
Makefile | -rw-r--r-- | 2.7 KB |
argv_split.c | -rw-r--r-- | 1.8 KB |
audit.c | -rw-r--r-- | 1.2 KB |
bcd.c | -rw-r--r-- | 257 bytes |
bitmap.c | -rw-r--r-- | 30.0 KB |
bitrev.c | -rw-r--r-- | 2.1 KB |
bug.c | -rw-r--r-- | 4.1 KB |
bust_spinlocks.c | -rw-r--r-- | 588 bytes |
check_signature.c | -rw-r--r-- | 599 bytes |
cmdline.c | -rw-r--r-- | 3.6 KB |
cpumask.c | -rw-r--r-- | 752 bytes |
crc-ccitt.c | -rw-r--r-- | 3.0 KB |
crc-itu-t.c | -rw-r--r-- | 2.8 KB |
crc-t10dif.c | -rw-r--r-- | 2.9 KB |
crc16.c | -rw-r--r-- | 2.8 KB |
crc32.c | -rw-r--r-- | 14.9 KB |
crc32defs.h | -rw-r--r-- | 1.0 KB |
crc7.c | -rw-r--r-- | 2.3 KB |
ctype.c | -rw-r--r-- | 1.3 KB |
debug_locks.c | -rw-r--r-- | 1.1 KB |
debugobjects.c | -rw-r--r-- | 20.9 KB |
dec_and_lock.c | -rw-r--r-- | 806 bytes |
devres.c | -rw-r--r-- | 7.7 KB |
div64.c | -rw-r--r-- | 2.3 KB |
dump_stack.c | -rw-r--r-- | 290 bytes |
extable.c | -rw-r--r-- | 1.9 KB |
fault-inject.c | -rw-r--r-- | 7.9 KB |
find_next_bit.c | -rw-r--r-- | 6.4 KB |
gen_crc32table.c | -rw-r--r-- | 1.8 KB |
genalloc.c | -rw-r--r-- | 5.3 KB |
halfmd4.c | -rw-r--r-- | 2.0 KB |
hexdump.c | -rw-r--r-- | 6.1 KB |
hweight.c | -rw-r--r-- | 1.6 KB |
idr.c | -rw-r--r-- | 20.3 KB |
inflate.c | -rw-r--r-- | 38.6 KB |
int_sqrt.c | -rw-r--r-- | 533 bytes |
iomap.c | -rw-r--r-- | 7.4 KB |
iomap_copy.c | -rw-r--r-- | 2.1 KB |
iommu-helper.c | -rw-r--r-- | 1.8 KB |
ioremap.c | -rw-r--r-- | 2.1 KB |
irq_regs.c | -rw-r--r-- | 578 bytes |
kasprintf.c | -rw-r--r-- | 680 bytes |
kernel_lock.c | -rw-r--r-- | 2.9 KB |
klist.c | -rw-r--r-- | 7.5 KB |
kobject.c | -rw-r--r-- | 20.6 KB |
kobject_uevent.c | -rw-r--r-- | 8.0 KB |
kref.c | -rw-r--r-- | 1.9 KB |
libcrc32c.c | -rw-r--r-- | 6.4 KB |
list_debug.c | -rw-r--r-- | 1.5 KB |
lmb.c | -rw-r--r-- | 11.6 KB |
locking-selftest-hardirq.h | -rw-r--r-- | 207 bytes |
locking-selftest-mutex.h | -rw-r--r-- | 120 bytes |
locking-selftest-rlock-hardirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-rlock-softirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-rlock.h | -rw-r--r-- | 158 bytes |
locking-selftest-rsem.h | -rw-r--r-- | 163 bytes |
locking-selftest-softirq.h | -rw-r--r-- | 207 bytes |
locking-selftest-spin-hardirq.h | -rw-r--r-- | 73 bytes |
locking-selftest-spin-softirq.h | -rw-r--r-- | 73 bytes |
locking-selftest-spin.h | -rw-r--r-- | 118 bytes |
locking-selftest-wlock-hardirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-wlock-softirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-wlock.h | -rw-r--r-- | 158 bytes |
locking-selftest-wsem.h | -rw-r--r-- | 163 bytes |
locking-selftest.c | -rw-r--r-- | 28.6 KB |
parser.c | -rw-r--r-- | 6.0 KB |
percpu_counter.c | -rw-r--r-- | 3.2 KB |
plist.c | -rw-r--r-- | 2.8 KB |
prio_heap.c | -rw-r--r-- | 1.4 KB |
prio_tree.c | -rw-r--r-- | 12.2 KB |
proportions.c | -rw-r--r-- | 9.3 KB |
radix-tree.c | -rw-r--r-- | 30.9 KB |
random32.c | -rw-r--r-- | 3.8 KB |
ratelimit.c | -rw-r--r-- | 1.3 KB |
rbtree.c | -rw-r--r-- | 8.6 KB |
reciprocal_div.c | -rw-r--r-- | 159 bytes |
rwsem-spinlock.c | -rw-r--r-- | 6.8 KB |
rwsem.c | -rw-r--r-- | 6.4 KB |
scatterlist.c | -rw-r--r-- | 11.7 KB |
sha1.c | -rw-r--r-- | 2.4 KB |
show_mem.c | -rw-r--r-- | 1.4 KB |
smp_processor_id.c | -rw-r--r-- | 1.1 KB |
sort.c | -rw-r--r-- | 2.5 KB |
spinlock_debug.c | -rw-r--r-- | 6.8 KB |
string.c | -rw-r--r-- | 13.6 KB |
swiotlb.c | -rw-r--r-- | 24.1 KB |
syscall.c | -rw-r--r-- | 2.4 KB |
textsearch.c | -rw-r--r-- | 9.5 KB |
ts_bm.c | -rw-r--r-- | 5.3 KB |
ts_fsm.c | -rw-r--r-- | 10.6 KB |
ts_kmp.c | -rw-r--r-- | 4.3 KB |
vsprintf.c | -rw-r--r-- | 27.7 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...