[PATCH] floppy I/O error handling => Oops

[PATCH] floppy I/O error handling => Oops

[Randy.Dunlap]

bad_flp_intr() in floppy.c can cause an Oops if the I/O request is
freed but <errors> still points into the I/O request block.

Here is a simple patch that fixes it.  The ordering of the if/else
conditionals might be improved, but this works (for me).

bad_flp_intr() oopsen reports:

Andrey: http://marc.theaimsgroup.com/?l=linux-kernel&m=105837886921297&w=2
John:   http://marc.theaimsgroup.com/?l=linux-kernel&m=106303650007125&w=2
Barry:  http://bugme.osdl.org/show_bug.cgi?id=1033

--
~Randy


patch_name:	floppyio_errors.patch
patch_version:	2003-09-21.11:10:08
author:		Randy.Dunlap <rddunlap@osdl.org>
description:	don't use the <errors> pointer after calling cont->done();
		it can be invalid since it points into a req block
		which may have been freed;
product:	Linux
product_versions: 2.6.0-test5
diffstat:	=
 drivers/block/floppy.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

The ordering of the if/else conditionals may need to change.

diff -Naur ./drivers/block/floppy.c~flopio ./drivers/block/floppy.c
--- ./drivers/block/floppy.c~flopio	2003-09-08 12:49:53.000000000 -0700
+++ ./drivers/block/floppy.c	2003-09-21 11:03:17.000000000 -0700
@@ -2161,7 +2174,7 @@
 	INFBOUND(DRWE->badness, *errors);
 	if (*errors > DP->max_errors.abort)
 		cont->done(0);
-	if (*errors > DP->max_errors.reset)
+	else if (*errors > DP->max_errors.reset)
 		FDCS->reset = 1;
 	else if (*errors > DP->max_errors.recal)
 		DRS->track = NEED_2_RECAL;

Re: [PATCH] floppy I/O error handling => Oops

[Randy.Dunlap]

On Sun, 21 Sep 2003 11:39:30 -0700 "Randy.Dunlap" <rddunlap@osdl.org> wrote:

| 
| bad_flp_intr() in floppy.c can cause an Oops if the I/O request is
| freed but <errors> still points into the I/O request block.
| 
| bad_flp_intr() oopsen reports:
| 
| Andrey: http://marc.theaimsgroup.com/?l=linux-kernel&m=105837886921297&w=2
| John:   http://marc.theaimsgroup.com/?l=linux-kernel&m=106303650007125&w=2
| Barry:  http://bugme.osdl.org/show_bug.cgi?id=1033

Here's an alternate patch.  Is it preferable?
Still works for me.

--
~Randy


patch_name:	flopio2_errors.patch
patch_version:	2003-09-21.12:26:38
author:		Randy.Dunlap <rddunlap@osdl.org>
description:	don't use <errors> pointer after calling cont->done();
		the request block can become invalid;
product:	Linux
product_versions: 2.6.0-test5
diffstat:	=
 drivers/block/floppy.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)


diff -Naur ./drivers/block/floppy.c~flopio ./drivers/block/floppy.c
--- ./drivers/block/floppy.c~flopio	2003-09-08 12:49:53.000000000 -0700
+++ ./drivers/block/floppy.c	2003-09-21 12:25:01.000000000 -0700
@@ -2152,18 +2152,20 @@
 
 static void bad_flp_intr(void)
 {
+	int errcount;
 	if (probing){
 		DRS->probed_format++;
 		if (!next_valid_format())
 			return;
 	}
 	(*errors)++;
+	errcount = *errors;
 	INFBOUND(DRWE->badness, *errors);
-	if (*errors > DP->max_errors.abort)
+	if (errcount > DP->max_errors.abort)
 		cont->done(0);
-	if (*errors > DP->max_errors.reset)
+	if (errcount > DP->max_errors.reset)
 		FDCS->reset = 1;
-	else if (*errors > DP->max_errors.recal)
+	else if (errcount > DP->max_errors.recal)
 		DRS->track = NEED_2_RECAL;
 }