RE: PROBLEM: ide-cd panic with faulty disk and DMA enabled (2.6.0-test9)

["Csaba Halasz" <Jester01@freemail.hu>]

Hi!

I did some more experimenting last night, and I think
I have stumbled upon something. Don't know
what it means or how to fix it though :)

The request is indeed freed by cdrom_end_request.
The reason is that rq->nr_sectors is an insane value.
And that is because restore_request screwed up.

Just before the crash, in restore_request (ide-cd.c:1346 or so):

restore_request: rq = 0xde158f60, rq->buffer = 0x00000000, bio_data(rq->bio) = 0xc654b000, n=1889704
restore_request: dev hdd: flags = REQ_CMD REQ_STARTED 
sector 7043336, nr/cnr 240/8
bio de09e610, biotail de09e720, buffer 00000000, data 00000000, len 1515870810

The rq->nr_sectors value of 240 will be adjusted to 1889944!
The fix might be as simple as checking for a NULL rq->buffer, but
I don't really understand what is going on here.

Also, somebody else seems to mess with rq->nr_sectors as well,
because I have added a sanity check to cdrom_read_intr and
it catches another such bug, but this time with no preceding
restore_request call...

Hope this helps.

I have also tried ide-scsi, that crashes spectacularly as well.
But I'll start a new thread for that :-)

Greets,
	Csaba