[PATCH] off-by-1 error in ide-probe (2.4.x)

[Paul Gortmaker]

There is a potentially serious bug in ide-probe.c in which max_sectors
is set to 256 instead of 255.  I am surprised that this hasn't bit anyone
else yet.  Perhaps because you need a disk that is slow in comparison to 
the host in order for the queue to climb up to and then hit the 256, at
which point it then falls over.  

For example, with an old 700MB Maxtor on a "fast" 486, VL-bus, PIO, 
hdparm -c1 -m8 -u1, I could pretty much on demand generate the following 
error by multiple builds, or by the final linking of any big project:

   hdc: lost interrupt
   hdc: status error: status=0x58 { DriveReady SeekComplete DataRequest }
   hdc: drive not ready for command
   <user space sees binary cruft in source files, etc etc...>

(Note that nothing in the status is really an error).  With the following 
patch, everything works as it should & no errors even under high load.
Patch is against 2.4.3pre2.

Paul.

--- drivers/ide/ide-probe.c~	Sat Mar 17 16:50:14 2001
+++ drivers/ide/ide-probe.c	Sat Mar 17 16:58:33 2001
@@ -1,5 +1,5 @@
 /*
- *  linux/drivers/ide/ide-probe.c	Version 1.06	June 9, 2000
+ *  linux/drivers/ide/ide-probe.c	Version 1.07	March 18, 2001
  *
  *  Copyright (C) 1994-1998  Linus Torvalds & authors (see below)
  */
@@ -25,6 +25,8 @@
  *			allowed for secondary flash card to be detectable
  *			 with new flag : drive->ata_flash : 1;
  * Version 1.06		stream line request queue and prep for cascade project.
+ * Version 1.07		max_sect <= 255; slower disks would get behind and
+ * 			then fall over when they get to 256.	Paul G.
  */
 
 #undef REALLY_SLOW_IO		/* most systems can safely undef this */
@@ -772,10 +774,10 @@
 	for (unit = 0; unit < minors; ++unit) {
 		*bs++ = BLOCK_SIZE;
 #ifdef CONFIG_BLK_DEV_PDC4030
-		*max_sect++ = ((hwif->chipset == ide_pdc4030) ? 127 : 256);
+		*max_sect++ = ((hwif->chipset == ide_pdc4030) ? 127 : 255);
 #else
 		/* IDE can do up to 128K per request. */
-		*max_sect++ = 256;
+		*max_sect++ = 255;
 #endif
 		*max_ra++ = MAX_READAHEAD;
 	}