summaryrefslogtreecommitdiffstats
path: root/drivers/ide/ide-disk.c
diff options
context:
space:
mode:
authorBorislav Petkov <bp@alien8.de>2011-10-03 14:28:18 -0400
committerDavid S. Miller <davem@davemloft.net>2011-10-03 14:28:18 -0400
commit2c8fc867602e385fd2abe76da0b6bda8ed907547 (patch)
tree21507c7b823953e8632ae4a1853d1196b6ff02a3 /drivers/ide/ide-disk.c
parent9b13776977d45505469edc6decc93e9e3799afe2 (diff)
downloadlinux-2c8fc867602e385fd2abe76da0b6bda8ed907547.tar.gz
linux-2c8fc867602e385fd2abe76da0b6bda8ed907547.tar.bz2
linux-2c8fc867602e385fd2abe76da0b6bda8ed907547.zip
ide-disk: Fix request requeuing
Simon Kirby reported that on his RAID setup with idedisk underneath the box OOMs after a couple of days of runtime. Running with CONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally allocates an ide_cmd struct. However, ide_requeue_and_plug() can be called more than once per request, either from the request issue or the IRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn() repeatedly, allocating a struct ide_cmd everytime and "forgetting" the previous pointer. Make sure the code reuses the old allocated chunk. Reported-and-tested-by: Simon Kirby <sim@hostway.ca> Cc: <stable@kernel.org> [ 39.x, 3.0.x ] Link: http://marc.info/?l=linux-kernel&m=131667641517919 Link: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca Signed-off-by: Borislav Petkov <bp@alien8.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/ide/ide-disk.c')
-rw-r--r--drivers/ide/ide-disk.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 274798068a54..16f69be820c7 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -435,7 +435,12 @@ static int idedisk_prep_fn(struct request_queue *q, struct request *rq)
if (!(rq->cmd_flags & REQ_FLUSH))
return BLKPREP_OK;
- cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+ if (rq->special) {
+ cmd = rq->special;
+ memset(cmd, 0, sizeof(*cmd));
+ } else {
+ cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+ }
/* FIXME: map struct ide_taskfile on rq->cmd[] */
BUG_ON(cmd == NULL);