When block layer fails to map iov, it calls bio_unmap_user to undo

mapping. Which is good if pages were mapped - but if they were provided by someone else and just copied then bad things happen - pages are released once here, and once by caller, leading to user triggerable BUG at include/linux/mm.h:246. Signed-off-by: Petr Vandrovec <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
mrcsosa · Dec 3, 2008 · 53cc0b2 · 53cc0b2
1 parent f6f7b52
commit 53cc0b2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/block/blk-map.c b/block/blk-map.c
@@ -224,7 +224,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
 		 */
 		bio_get(bio);
 		bio_endio(bio, 0);
-		bio_unmap_user(bio);
+		__blk_rq_unmap_user(bio);
 		return -EINVAL;
 	}