From 87ad90016483f7f112021c7c82d3d72e682324f6 Mon Sep 17 00:00:00 2001 From: Jeff Garzik Date: Mon, 15 Oct 2007 11:02:15 +0200 Subject: drivers/block/cpqarray,cciss: kill unused var The recent bio work and subsequent fixups created unused variables. Signed-off-by: Jeff Garzik Signed-off-by: Jens Axboe --- drivers/block/cciss.c | 1 - drivers/block/cpqarray.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) (limited to 'drivers/block') diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c index 55c3237..a895228 100644 --- a/drivers/block/cciss.c +++ b/drivers/block/cciss.c @@ -1191,7 +1191,6 @@ static inline void complete_buffers(struct bio *bio, int status) { while (bio) { struct bio *xbh = bio->bi_next; - int nr_sectors = bio_sectors(bio); bio->bi_next = NULL; bio_endio(bio, status ? 0 : -EIO); diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c index 3853c9a..568603d 100644 --- a/drivers/block/cpqarray.c +++ b/drivers/block/cpqarray.c @@ -981,9 +981,8 @@ static void start_io(ctlr_info_t *h) static inline void complete_buffers(struct bio *bio, int ok) { struct bio *xbh; - while(bio) { - int nr_sectors = bio_sectors(bio); + while (bio) { xbh = bio->bi_next; bio->bi_next = NULL; -- cgit v1.1 From fd5d806266935179deda1502101624832eacd01f Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Tue, 16 Oct 2007 11:05:02 +0200 Subject: block: convert blkdev_issue_flush() to use empty barriers Then we can get rid of ->issue_flush_fn() and all the driver private implementations of that. Signed-off-by: Jens Axboe --- drivers/block/ps3disk.c | 21 --------------------- 1 file changed, 21 deletions(-) (limited to 'drivers/block') diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c index 06d0552..e354bfc 100644 --- a/drivers/block/ps3disk.c +++ b/drivers/block/ps3disk.c @@ -414,26 +414,6 @@ static void ps3disk_prepare_flush(struct request_queue *q, struct request *req) req->cmd_type = REQ_TYPE_FLUSH; } -static int ps3disk_issue_flush(struct request_queue *q, struct gendisk *gendisk, - sector_t *sector) -{ - struct ps3_storage_device *dev = q->queuedata; - struct request *req; - int res; - - dev_dbg(&dev->sbd.core, "%s:%u\n", __func__, __LINE__); - - req = blk_get_request(q, WRITE, __GFP_WAIT); - ps3disk_prepare_flush(q, req); - res = blk_execute_rq(q, gendisk, req, 0); - if (res) - dev_err(&dev->sbd.core, "%s:%u: flush request failed %d\n", - __func__, __LINE__, res); - blk_put_request(req); - return res; -} - - static unsigned long ps3disk_mask; static DEFINE_MUTEX(ps3disk_mask_mutex); @@ -506,7 +486,6 @@ static int __devinit ps3disk_probe(struct ps3_system_bus_device *_dev) blk_queue_dma_alignment(queue, dev->blk_size-1); blk_queue_hardsect_size(queue, dev->blk_size); - blk_queue_issue_flush_fn(queue, ps3disk_issue_flush); blk_queue_ordered(queue, QUEUE_ORDERED_DRAIN_FLUSH, ps3disk_prepare_flush); -- cgit v1.1 From 761a15e7ac0be7df0c86a55f38a84c080fa179ae Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Fri, 14 Sep 2007 13:06:53 +0200 Subject: pktcdvd: don't rely on bio_init() preserving bio->bi_io_vec Signed-off-by: Jens Axboe --- drivers/block/pktcdvd.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'drivers/block') diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c index 540bf36..ba2f550 100644 --- a/drivers/block/pktcdvd.c +++ b/drivers/block/pktcdvd.c @@ -1133,16 +1133,20 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt) * Schedule reads for missing parts of the packet. */ for (f = 0; f < pkt->frames; f++) { + struct bio_vec *vec; + int p, offset; if (written[f]) continue; bio = pkt->r_bios[f]; + vec = bio->bi_io_vec; bio_init(bio); bio->bi_max_vecs = 1; bio->bi_sector = pkt->sector + f * (CD_FRAMESIZE >> 9); bio->bi_bdev = pd->bdev; bio->bi_end_io = pkt_end_io_read; bio->bi_private = pkt; + bio->bi_io_vec = vec; p = (f * CD_FRAMESIZE) / PAGE_SIZE; offset = (f * CD_FRAMESIZE) % PAGE_SIZE; @@ -1439,6 +1443,7 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt) pkt->w_bio->bi_bdev = pd->bdev; pkt->w_bio->bi_end_io = pkt_end_io_packet_write; pkt->w_bio->bi_private = pkt; + pkt->w_bio->bi_io_vec = bvec; for (f = 0; f < pkt->frames; f++) if (!bio_add_page(pkt->w_bio, bvec[f].bv_page, CD_FRAMESIZE, bvec[f].bv_offset)) BUG(); -- cgit v1.1 From 7e3da6c4b9a69f44b758b2c88190ac33ac4ea1a1 Mon Sep 17 00:00:00 2001 From: Laurent Riffard Date: Fri, 21 Sep 2007 08:32:28 +0200 Subject: pktcdvd: don't rely on bio_init() preserving bio->bi_destructor Signed-off-by: Laurent Riffard Signed-off-by: Jens Axboe --- drivers/block/pktcdvd.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/block') diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c index ba2f550..a8130a4 100644 --- a/drivers/block/pktcdvd.c +++ b/drivers/block/pktcdvd.c @@ -1147,6 +1147,7 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt) bio->bi_end_io = pkt_end_io_read; bio->bi_private = pkt; bio->bi_io_vec = vec; + bio->bi_destructor = pkt_bio_destructor; p = (f * CD_FRAMESIZE) / PAGE_SIZE; offset = (f * CD_FRAMESIZE) % PAGE_SIZE; @@ -1444,6 +1445,7 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt) pkt->w_bio->bi_end_io = pkt_end_io_packet_write; pkt->w_bio->bi_private = pkt; pkt->w_bio->bi_io_vec = bvec; + pkt->w_bio->bi_destructor = pkt_bio_destructor; for (f = 0; f < pkt->frames; f++) if (!bio_add_page(pkt->w_bio, bvec[f].bv_page, CD_FRAMESIZE, bvec[f].bv_offset)) BUG(); -- cgit v1.1 From a683d652d334a546be9175b894f42dbd8e399536 Mon Sep 17 00:00:00 2001 From: Lee Schermerhorn Date: Fri, 21 Sep 2007 08:33:55 +0200 Subject: Panic in blk_rq_map_sg() from CCISS driver New scatter/gather list chaining [sg_next()] treats 'page' member of struct scatterlist with low bit set [0x01] as a chain pointer to another struct scatterlist [array]. The CCISS driver request function passes an uninitialized, temporary, on-stack scatterlist array to blk_rq_map_sq(). sg_next() interprets random data on the stack as a chain pointer and eventually tries to de-reference an invalid pointer, resulting in: [] blk_rq_map_sg+0x70/0x170 PGD 6090c3067 PUD 0 Oops: 0000 [1] SMP last sysfs file: /block/cciss!c0d0/cciss!c0d0p1/dev CPU 6 Modules linked in: ehci_hcd ohci_hcd uhci_hcd Pid: 1, comm: init Not tainted 2.6.23-rc6-mm1 #3 RIP: 0010:[] [] blk_rq_map_sg+0x70/0x170 RSP: 0018:ffff81060901f768 EFLAGS: 00010206 RAX: 000000040b161000 RBX: ffff81060901f7d8 RCX: 000000040b162c00 RDX: 0000000000000000 RSI: ffff81060b13a260 RDI: ffff81060b139600 RBP: 0000000000001400 R08: 00000000fffffffe R09: 0000000000000400 R10: 0000000000000000 R11: 000000040b163000 R12: ffff810102fe0000 R13: 0000000000000001 R14: 0000000000000001 R15: 00001e0000000000 FS: 00000000026108f0(0063) GS:ffff810409000b80(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000010000001e CR3: 00000006090c6000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process init (pid: 1, threadinfo ffff81060901e000, task ffff810409020800) last branch before last exception/interrupt from [] blk_rq_map_sg+0x10a/0x170 to [] blk_rq_map_sg+0x70/0x170 Stack: 000000018068ea00 ffff810102fe0000 0000000000000000 ffff810011400000 0000000000000002 0000000000000000 ffff81040b172000 ffffffff803acd3d 0000000000003ec1 ffff8106090d5000 ffff8106090d5000 ffff810102fe0000 Call Trace: [] do_cciss_request+0x15d/0x4c0 [] new_slab+0x1c8/0x270 [] __slab_alloc+0x22d/0x470 [] mempool_alloc+0x4b/0x130 [] cfq_set_request+0xee/0x380 [] mempool_alloc+0x4b/0x130 [] get_request+0x168/0x360 [] rb_insert_color+0x8d/0x110 [] elv_rb_add+0x58/0x60 [] cfq_add_rq_rb+0x69/0xa0 [] elv_merged_request+0x5b/0x60 [] __make_request+0x23d/0x650 [] __slab_alloc+0x22d/0x470 [] generic_write_checks+0x140/0x190 [] generic_make_request+0x1c2/0x3a0 Kernel panic - not syncing: Attempted to kill init! This patch initializes the tmp_sg array to zeroes. Perhaps not the ultimate fix, but an effective work-around. I can now boot 23-rc6-mm1 on an HP Proliant x86_64 with CCISS boot disk. Signed-off-by: Lee Schermerhorn drivers/block/cciss.c | 1 + 1 file changed, 1 insertion(+) Signed-off-by: Jens Axboe --- drivers/block/cciss.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/block') diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c index 55c3237..2023d61 100644 --- a/drivers/block/cciss.c +++ b/drivers/block/cciss.c @@ -2570,6 +2570,7 @@ static void do_cciss_request(struct request_queue *q) (int)creq->nr_sectors); #endif /* CCISS_DEBUG */ + memset(tmp_sg, 0, sizeof(tmp_sg)); seg = blk_rq_map_sg(q, creq, tmp_sg); /* get the DMA records for the setup */ -- cgit v1.1