aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPetr Vandrovec2008-11-19 04:12:14 -0600
committerJens Axboe2008-12-03 05:41:20 -0600
commit53cc0b2948bcb8a084982e6c1f9bd7b337e0df38 (patch)
treee2d4ca231035de3a14f47b97f6c9196fc375340c
parentf6f7b52e2f6149d2ee365717afff315b05720162 (diff)
downloadkernel-common-53cc0b2948bcb8a084982e6c1f9bd7b337e0df38.tar.gz
kernel-common-53cc0b2948bcb8a084982e6c1f9bd7b337e0df38.tar.xz
kernel-common-53cc0b2948bcb8a084982e6c1f9bd7b337e0df38.zip
When block layer fails to map iov, it calls bio_unmap_user to undo
mapping. Which is good if pages were mapped - but if they were provided by someone else and just copied then bad things happen - pages are released once here, and once by caller, leading to user triggerable BUG at include/linux/mm.h:246. Signed-off-by: Petr Vandrovec <petr@vandrovec.name> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
-rw-r--r--block/blk-map.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/block/blk-map.c b/block/blk-map.c
index 0f4b4b88181..2990447f45e 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -224,7 +224,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
224 */ 224 */
225 bio_get(bio); 225 bio_get(bio);
226 bio_endio(bio, 0); 226 bio_endio(bio, 0);
227 bio_unmap_user(bio); 227 __blk_rq_unmap_user(bio);
228 return -EINVAL; 228 return -EINVAL;
229 } 229 }
230 230