Skip to content

Commit 0cbc72a

Browse files
committed
aoe: fix crash in page count manipulation
aoeblk contains some mysterious code, that wants to elevate the bio vec page counts while it's under IO. That is not needed, it's fragile, and it's causing kernel oopses for some. Reported-by: Tested-by: Don Koch <[email protected]> Tested-by: Tested-by: Don Koch <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
1 parent 409ae5a commit 0cbc72a

File tree

1 file changed

+0
-41
lines changed

1 file changed

+0
-41
lines changed

drivers/block/aoe/aoecmd.c

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -853,53 +853,13 @@ rqbiocnt(struct request *r)
853853
return n;
854854
}
855855

856-
/* This can be removed if we are certain that no users of the block
857-
* layer will ever use zero-count pages in bios. Otherwise we have to
858-
* protect against the put_page sometimes done by the network layer.
859-
*
860-
* See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
861-
* discussion.
862-
*
863-
* We cannot use get_page in the workaround, because it insists on a
864-
* positive page count as a precondition. So we use _refcount directly.
865-
*/
866-
static void
867-
bio_pageinc(struct bio *bio)
868-
{
869-
struct bio_vec bv;
870-
struct page *page;
871-
struct bvec_iter iter;
872-
873-
bio_for_each_segment(bv, bio, iter) {
874-
/* Non-zero page count for non-head members of
875-
* compound pages is no longer allowed by the kernel.
876-
*/
877-
page = compound_head(bv.bv_page);
878-
page_ref_inc(page);
879-
}
880-
}
881-
882-
static void
883-
bio_pagedec(struct bio *bio)
884-
{
885-
struct page *page;
886-
struct bio_vec bv;
887-
struct bvec_iter iter;
888-
889-
bio_for_each_segment(bv, bio, iter) {
890-
page = compound_head(bv.bv_page);
891-
page_ref_dec(page);
892-
}
893-
}
894-
895856
static void
896857
bufinit(struct buf *buf, struct request *rq, struct bio *bio)
897858
{
898859
memset(buf, 0, sizeof(*buf));
899860
buf->rq = rq;
900861
buf->bio = bio;
901862
buf->iter = bio->bi_iter;
902-
bio_pageinc(bio);
903863
}
904864

905865
static struct buf *
@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf *buf)
11271087
if (buf == d->ip.buf)
11281088
d->ip.buf = NULL;
11291089
rq = buf->rq;
1130-
bio_pagedec(buf->bio);
11311090
mempool_free(buf, d->bufpool);
11321091
n = (unsigned long) rq->special;
11331092
rq->special = (void *) --n;

0 commit comments

Comments
 (0)