Commit 11071282 authored by Borislav Petkov's avatar Borislav Petkov Committed by David S. Miller

ide-cd: Do not access completed requests in the irq handler

ide_cd_error_cmd() can complete an erroneous request with leftover
buffers. Signal this with its return value so that the request is not
accessed after its completion in the irq handler and we oops.

Cc: <stable@kernel.org> # 32.x 33.x 34.x
Signed-off-by: default avatarBorislav Petkov <bp@alien8.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 45d7f32c
...@@ -506,15 +506,22 @@ int ide_cd_queue_pc(ide_drive_t *drive, const unsigned char *cmd, ...@@ -506,15 +506,22 @@ int ide_cd_queue_pc(ide_drive_t *drive, const unsigned char *cmd,
return (flags & REQ_FAILED) ? -EIO : 0; return (flags & REQ_FAILED) ? -EIO : 0;
} }
static void ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd) /*
* returns true if rq has been completed
*/
static bool ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
{ {
unsigned int nr_bytes = cmd->nbytes - cmd->nleft; unsigned int nr_bytes = cmd->nbytes - cmd->nleft;
if (cmd->tf_flags & IDE_TFLAG_WRITE) if (cmd->tf_flags & IDE_TFLAG_WRITE)
nr_bytes -= cmd->last_xfer_len; nr_bytes -= cmd->last_xfer_len;
if (nr_bytes > 0) if (nr_bytes > 0) {
ide_complete_rq(drive, 0, nr_bytes); ide_complete_rq(drive, 0, nr_bytes);
return true;
}
return false;
} }
static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive) static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
...@@ -679,7 +686,8 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive) ...@@ -679,7 +686,8 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
} }
if (uptodate == 0 && rq->bio) if (uptodate == 0 && rq->bio)
ide_cd_error_cmd(drive, cmd); if (ide_cd_error_cmd(drive, cmd))
return ide_stopped;
/* make sure it's fully ended */ /* make sure it's fully ended */
if (blk_fs_request(rq) == 0) { if (blk_fs_request(rq) == 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment