["Hua Zhong" <hzhong@gmail.com>]

Hi,

In 2.6.15.1 I encountered some IDE crashes when unplugging IDE cables to
emulate disk errors. Below is a patch against 2.6.16 which I think still
applies.

1. The first BUG_ON could trigger when a PREFLUSH IO fails (it would fail
the original barrier request which hasn't been marked REQ_STARTED yet).
2. the rq could have been dequeued already (same as 1).
3. HWGROUP(drive)->rq could be NULL because of the ide_error() several lines
earlier.

Signed off by: Hua Zhong <hzhong@gmail.com>

diff -ur linux-2.6.16.orig/drivers/ide/ide-io.c
linux-2.6.16/drivers/ide/ide-io.c
--- linux-2.6.16.orig/drivers/ide/ide-io.c	2006-03-19
21:53:29.000000000 -0800
+++ linux-2.6.16/drivers/ide/ide-io.c	2006-04-01 00:26:55.411871520 -0800
@@ -60,8 +60,6 @@
 {
 	int ret = 1;
 
-	BUG_ON(!(rq->flags & REQ_STARTED));
-
 	/*
 	 * if failfast is set on a request, override number of sectors and
 	 * complete the whole request right now
@@ -83,7 +81,8 @@
 
 	if (!end_that_request_first(rq, uptodate, nr_sectors)) {
 		add_disk_randomness(rq->rq_disk);
-		blkdev_dequeue_request(rq);
+		if (!list_empty(&rq->queuelist))
+			blkdev_dequeue_request(rq);
 		HWGROUP(drive)->rq = NULL;
 		end_that_request_last(rq, uptodate);
 		ret = 0;
@@ -1277,6 +1276,10 @@
 	 * make sure request is sane
 	 */
 	rq = HWGROUP(drive)->rq;
+
+	if (!rq)
+		goto out;
+
 	HWGROUP(drive)->rq = NULL;
 
 	rq->errors = 0;