From: "Hua Zhong" In 2.6.15.1 I encountered some IDE crashes when unplugging IDE cables to emulate disk errors. Below is a patch against 2.6.16 which I think still applies. 1. The first BUG_ON could trigger when a PREFLUSH IO fails (it would fail the original barrier request which hasn't been marked REQ_STARTED yet). 2. the rq could have been dequeued already (same as 1). 3. HWGROUP(drive)->rq could be NULL because of the ide_error() several lines earlier. Signed-off-by: Hua Zhong Cc: Bartlomiej Zolnierkiewicz Cc: Alan Cox Signed-off-by: Andrew Morton --- drivers/ide/ide-io.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff -puN drivers/ide/ide-io.c~ide-error-handling-fixes drivers/ide/ide-io.c --- a/drivers/ide/ide-io.c~ide-error-handling-fixes +++ a/drivers/ide/ide-io.c @@ -59,8 +59,6 @@ static int __ide_end_request(ide_drive_t { int ret = 1; - BUG_ON(!blk_rq_started(rq)); - /* * if failfast is set on a request, override number of sectors and * complete the whole request right now @@ -82,7 +80,8 @@ static int __ide_end_request(ide_drive_t if (!end_that_request_first(rq, uptodate, nr_sectors)) { add_disk_randomness(rq->rq_disk); - blkdev_dequeue_request(rq); + if (!list_empty(&rq->queuelist)) + blkdev_dequeue_request(rq); HWGROUP(drive)->rq = NULL; end_that_request_last(rq, uptodate); ret = 0; @@ -1346,6 +1345,10 @@ static ide_startstop_t ide_dma_timeout_r * make sure request is sane */ rq = HWGROUP(drive)->rq; + + if (!rq) + goto out; + HWGROUP(drive)->rq = NULL; rq->errors = 0; _