Bug 216289

Summary:	ATIIXP IDE driver reuses ide_lock unsafely
Product:	[Fedora] Fedora	Reporter:	Alan Cox <alan>
Component:	kernel	Assignee:	Alan Cox <alan>
Status:	CLOSED UPSTREAM	QA Contact:	Brian Brock <bbrock>
Severity:	high	Docs Contact:
Priority:	medium
Version:	6	CC:	bill-bugzilla.redhat.com, brian.marsden, davej, h4x3r, klootzak, mgansser, t8m, wtogami
Target Milestone:	---
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	586482 (view as bug list)		Environment:
Last Closed:	2007-01-25 15:09:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alan Cox 2006-11-18 19:52:44 UTC

+++ This bug was initially created as a clone of Bug #178121 +++
Splitting this as its two bugs

-- Additional comment from bill+redhat on 2006-11-12 19:00 EST --
Some more information; I put in a Zod DVD to do an upgrade and the BIOS wasn't
set to boot from CD.  So when I came back to the computer I had the usual
lockup, but this time a stacktrace as well!  Included for your debugging pleasure:

BUG: spinlock recursion on CPU#0, swapper/0 (Not tainted)
lock: c06e6980, .magic: dead4end, .owner: swapper/0, .owner_cpu: 0
[<c05060ef>] dump_trace+0x69/0x1af
[<c040524d>] show_trace_log_lvl+0x18/0x2c
[<c0506800>] show_trace+0xf/0x11
[<c05068fa>] dump_stack+0x15/0x17
[<c04e82c9>] _raw_spin_lock+0x35/0xdc
[<c060fcd0>] _spin_lock_irqsave+0x9/0xd
[<c055875e>] atiixp_ide_dma_host_off+0x1b/0x7c
[<c056cd5a>] __ide_dma_off_quitely+0x19/0x23
[<c056c628>] __ide_dma_off+0x21/0x25
[<c05674b9>] do_reset1+0x42/0x191
[<c0566979>] __ide_error+0x197/0x1aa
[<c05669e8>] ide_error+0x5c/0x72
[<f8930c9e>] cdrom_decode_status+0x219/0x2a5 [ide_cd]
[<f8931466>] cdrom_read_intr+0x58/0x30e [ide_cd]
[<c0566708>] ide_intr+0x146/0x1a7
[<c044b95a>] handle_IRQ_event+0x23/0x49
[<c044ba16>] __do_IRQ+0x96/0xf2
[<c04067cf>] do_IRQ+0x9e/0xbc

Hopefully I typed all that correctly...

-- Additional comment from bill+redhat on 2006-11-18 03:22 EST --
For grins I replaced the Pioneer writer with an LG writer and the kernel crash
gives the same stack.

Someone with perms can set this for fc6, and clear NEEDINFO unless there's more
to collect.

Comment 1 Alan Cox 2007-01-02 15:42:49 UTC

Upstream patch prepared

Comment 2 Bill McGonigle 2007-01-04 20:33:24 UTC

URL for Alan's patch:
  http://lkml.org/lkml/diff/2007/1/2/126/1

(I'm not "sufficiently empowered") to modify the URL field.

Thanks, Alan.