[lkml]   [2011]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[10/38] ide-disk: Fix request requeuing
3.0-stable review patch.  If anyone has any objections, please let us know.


From: Borislav Petkov <>

commit 2c8fc867602e385fd2abe76da0b6bda8ed907547 upstream.

Simon Kirby reported that on his RAID setup with idedisk underneath
the box OOMs after a couple of days of runtime. Running with
CONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally
allocates an ide_cmd struct. However, ide_requeue_and_plug() can be
called more than once per request, either from the request issue or the
IRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn()
repeatedly, allocating a struct ide_cmd everytime and "forgetting" the
previous pointer.

Make sure the code reuses the old allocated chunk.

Reported-and-tested-by: Simon Kirby <>
Signed-off-by: Borislav Petkov <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/ide/ide-disk.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -435,7 +435,12 @@ static int idedisk_prep_fn(struct reques
if (!(rq->cmd_flags & REQ_FLUSH))
return BLKPREP_OK;

- cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+ if (rq->special) {
+ cmd = rq->special;
+ memset(cmd, 0, sizeof(*cmd));
+ } else {
+ cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+ }

/* FIXME: map struct ide_taskfile on rq->cmd[] */
BUG_ON(cmd == NULL);

 \ /
  Last update: 2011-10-11 19:07    [W:0.141 / U:4.616 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site