Messages in this thread | | | From | Bartlomiej Zolnierkiewicz <> | Subject | Re: [PATCH] ide-cd: prevent null pointer deref via cdrom_newpc_intr | Date | Sat, 20 Jun 2009 12:27:31 +0200 |
| |
On Thursday 18 June 2009 18:06:34 Borislav Petkov wrote: > Hi, > > On Thu, Jun 18, 2009 at 5:04 PM, Rainer Weikusat<rweikusat@mssgmbh.com> wrote: > > From: Rainer Weikusat <rweikusat@mssgmbh.com> > > > > With 2.6.30, the error handling code in cdrom_newpc_intr was changed > > to deal with partial request failures by normally completing the 'good' > > parts of a request and only 'error' the last (and presumably, > > incompletely transferred) bio associated with a particular > > request. In order to do this, ide_complete_rq is called over > > ide_cd_error_cmd() to partially complete the rq. The block layer > > does partial completion only for requests with bio's and if the > > rq doesn't have one (eg 'GPCMD_READ_DISC_INFO') the request is > > completed as a whole and the drive->hwif->rq pointer set to NULL > > afterwards. When calling ide_complete_rq again to report > > the error, this null pointer is derefenced, resulting in a kernel > > crash.
Rainer, thanks for fixing this bug (with a lot of extra points for the detailed explanation).
> @Bart: please apply.
applied [I kept the above patch description]
| |