From owner-freebsd-bugs@FreeBSD.ORG Sun Sep 7 13:10:15 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F1DDC16A4C0 for ; Sun, 7 Sep 2003 13:10:14 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5C6A543FCB for ; Sun, 7 Sep 2003 13:10:13 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h87KADUp071785 for ; Sun, 7 Sep 2003 13:10:13 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h87KADie071784; Sun, 7 Sep 2003 13:10:13 -0700 (PDT) Resent-Date: Sun, 7 Sep 2003 13:10:13 -0700 (PDT) Resent-Message-Id: <200309072010.h87KADie071784@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, David Gilbert Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0748616A4BF for ; Sun, 7 Sep 2003 13:02:58 -0700 (PDT) Received: from sizone.org (mortar.sizone.org [65.126.154.242]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7197F43FB1 for ; Sun, 7 Sep 2003 13:02:57 -0700 (PDT) (envelope-from dgilbert@daveg.ca) Received: by sizone.org (Postfix, from userid 66) id C61722FEE2; Sun, 7 Sep 2003 16:02:56 -0400 (EDT) Received: by canoe.dclg.ca (Postfix, from userid 101) id F3CCE1D1C42; Sun, 7 Sep 2003 16:02:26 -0400 (EDT) Message-Id: <20030907200226.F3CCE1D1C42@canoe.dclg.ca> Date: Sun, 7 Sep 2003 16:02:26 -0400 (EDT) From: David Gilbert To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/56572: ATAng sees zero sized disk... causes div-by-zero X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: David Gilbert List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Sep 2003 20:10:15 -0000 >Number: 56572 >Category: kern >Synopsis: ATAng sees zero sized disk... causes div-by-zero >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Sep 07 13:10:12 PDT 2003 >Closed-Date: >Last-Modified: >Originator: David Gilbert >Release: FreeBSD 5.1-CURRENT i386 >Organization: daveg.ca >Environment: System: FreeBSD canoe.dclg.ca 5.1-CURRENT FreeBSD 5.1-CURRENT #1: Sun Sep 7 15:46:19 EDT 2003 dgilbert@canoe.dclg.ca:/usr/src/sys/i386/compile/CANOE i386 Dell D800 laptop. Centrino processor, 1G RAM. >Description: The Dell has a two channel IDE controller. Channel 0 is the hard drive and channel 1 is the DVD+R drive. For some reason, ATAng sees a phanotm ad3 when the DVD+R is inserted (it is not seen when the DVD+R is removed.) This happens both when the DVD+R is hot-swapped in and when it is in at boot. I get a divide-by-zero panic in ad_print in ata-disk.c without the included patch. The dmesg now says: ata1: resetting devices .. acd0: CDRW at ata1-master WDMA2 ad3: FAILURE - total sectors 0 >How-To-Repeat: Boot with -CURRENT on my laptop. >Fix: This fix protects against zero length ata devices ... and should likely be left in regardless (malicious devices hot-swapped in shouldn't panic the kernel). This fix does not address why ATAng is detecting a phantom ad3. The ATA code previous to ATAng did not detect the phantom drive. --- /sys/dev/ata/ata-disk.orig Sun Sep 7 15:41:06 2003 +++ /sys/dev/ata/ata-disk.c Sun Sep 7 15:53:10 2003 @@ -96,6 +96,16 @@ adp->heads = atadev->param->heads; adp->sectors = atadev->param->sectors; adp->total_secs = atadev->param->cylinders * adp->heads * adp->sectors; + /* if the total sectors is zero, the size of the disk is zero + * and there's little good in attaching it (besides the fact + * that this would generate divide by zero errors later. + */ + if (adp->total_secs == 0) { + ata_prtdev(atadev, "FAILURE - total sectors 0\n"); + free(adp, M_AD); + atadev->attach = NULL; + return; + } if (adp->device->channel->flags & ATA_USE_PC98GEOM && adp->total_secs < 17 * 8 * 65536) { adp->sectors = 17; >Release-Note: >Audit-Trail: >Unformatted: