diff options
| author | Borislav Petkov <bp@alien8.de> | 2011-10-03 14:28:18 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-16 14:14:51 -0700 |
| commit | 3217df8e225c8579293fd2e193ba5cee709b6eba (patch) | |
| tree | fc527832020b5648dead7aada6cdd16e35229775 /drivers/ide | |
| parent | 4e41ce698822a9a2cfd324a11ea44f60fc95c871 (diff) | |
| download | kernel_samsung_aries-3217df8e225c8579293fd2e193ba5cee709b6eba.zip kernel_samsung_aries-3217df8e225c8579293fd2e193ba5cee709b6eba.tar.gz kernel_samsung_aries-3217df8e225c8579293fd2e193ba5cee709b6eba.tar.bz2 | |
ide-disk: Fix request requeuing
commit 2c8fc867602e385fd2abe76da0b6bda8ed907547 upstream.
Simon Kirby reported that on his RAID setup with idedisk underneath
the box OOMs after a couple of days of runtime. Running with
CONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally
allocates an ide_cmd struct. However, ide_requeue_and_plug() can be
called more than once per request, either from the request issue or the
IRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn()
repeatedly, allocating a struct ide_cmd everytime and "forgetting" the
previous pointer.
Make sure the code reuses the old allocated chunk.
Reported-and-tested-by: Simon Kirby <sim@hostway.ca>
Link: http://marc.info/?l=linux-kernel&m=131667641517919
Link: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca
Signed-off-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/ide')
| -rw-r--r-- | drivers/ide/ide-disk.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c index 2747980..16f69be 100644 --- a/drivers/ide/ide-disk.c +++ b/drivers/ide/ide-disk.c @@ -435,7 +435,12 @@ static int idedisk_prep_fn(struct request_queue *q, struct request *rq) if (!(rq->cmd_flags & REQ_FLUSH)) return BLKPREP_OK; - cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC); + if (rq->special) { + cmd = rq->special; + memset(cmd, 0, sizeof(*cmd)); + } else { + cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC); + } /* FIXME: map struct ide_taskfile on rq->cmd[] */ BUG_ON(cmd == NULL); |