When block layer fails to map iov, it calls bio_unmap_user to undo

mapping.  Which is good if pages were mapped - but if they were provided
by someone else and just copied then bad things happen - pages are
released once here, and once by caller, leading to user triggerable BUG
at include/linux/mm.h:246.

Signed-off-by: Petr Vandrovec <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

diff --git a/block/blk-map.c b/block/blk-map.c
index 0f4b4b88181178b0344127df63af79f7d95da915..2990447f45e913f7aa968ddc3979ea7b1a027a80 100644 (file)
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -224,7 +224,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
                 */
                bio_get(bio);
                bio_endio(bio, 0);
-               bio_unmap_user(bio);
+               __blk_rq_unmap_user(bio);
                return -EINVAL;
        }