From: Petr Vandrovec <petr@vandrovec.name>
Date: Wed, 19 Nov 2008 10:12:14 +0000 (+0100)
Subject: When block layer fails to map iov, it calls bio_unmap_user to undo
X-Git-Tag: v2.6.28-rc8~65^2~3
X-Git-Url: http://www.pilppa.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=53cc0b2948bcb8a084982e6c1f9bd7b337e0df38;p=linux-2.6-omap-h63xx.git

When block layer fails to map iov, it calls bio_unmap_user to undo
mapping.  Which is good if pages were mapped - but if they were provided
by someone else and just copied then bad things happen - pages are
released once here, and once by caller, leading to user triggerable BUG
at include/linux/mm.h:246.

Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
---

diff --git a/block/blk-map.c b/block/blk-map.c
index 0f4b4b88181..2990447f45e 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -224,7 +224,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 		 */
 		bio_get(bio);
 		bio_endio(bio, 0);
-		bio_unmap_user(bio);
+		__blk_rq_unmap_user(bio);
 		return -EINVAL;
 	}