History

aoe: fix crash in page count manipulation

aoeblk contains some mysterious code, that wants to elevate the bio vec page counts while it's under IO. That is not needed, it's fragile, and it's causing kernel oopses for some.

Jens Axboe committed 10 years ago

Commit 0cbc72a1 parent 409ae5a1 file · +0 −41Browse files

Unified · Split

drivers/block/aoe/aoecmd.c+0−41
@@ -853,45 +853,6 @@ rqbiocnt(struct request *r) · 852 unmodified lines
853 return n;853 return n;
854}854}
855 855
856/* This can be removed if we are certain that no users of the block
857 * layer will ever use zero-count pages in bios. Otherwise we have to
858 * protect against the put_page sometimes done by the network layer.
859 *
860 * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
861 * discussion.
862 *
863 * We cannot use get_page in the workaround, because it insists on a
864 * positive page count as a precondition. So we use _refcount directly.
865 */
866static void
867bio_pageinc(struct bio *bio)
868{
869 struct bio_vec bv;
870 struct page *page;
871 struct bvec_iter iter;
872
873 bio_for_each_segment(bv, bio, iter) {
874 /* Non-zero page count for non-head members of
875 * compound pages is no longer allowed by the kernel.
876 */
877 page = compound_head(bv.bv_page);
878 page_ref_inc(page);
879 }
880}
881
882static void
883bio_pagedec(struct bio *bio)
884{
885 struct page *page;
886 struct bio_vec bv;
887 struct bvec_iter iter;
888
889 bio_for_each_segment(bv, bio, iter) {
890 page = compound_head(bv.bv_page);
891 page_ref_dec(page);
892 }
893}
894
895static void856static void
896bufinit(struct buf *buf, struct request *rq, struct bio *bio)857bufinit(struct buf *buf, struct request *rq, struct bio *bio)
897{858{
@@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request *rq, struct bio *bio) · 1 unmodified line
899 buf->rq = rq;860 buf->rq = rq;
900 buf->bio = bio;861 buf->bio = bio;
901 buf->iter = bio->bi_iter;862 buf->iter = bio->bi_iter;
902 bio_pageinc(bio);
903}863}
904 864
905static struct buf *865static struct buf *
@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf *buf) · 221 unmodified lines
1127 if (buf == d->ip.buf)1087 if (buf == d->ip.buf)
1128 d->ip.buf = NULL;1088 d->ip.buf = NULL;
1129 rq = buf->rq;1089 rq = buf->rq;
1130 bio_pagedec(buf->bio);
1131 mempool_free(buf, d->bufpool);1090 mempool_free(buf, d->bufpool);
1132 n = (unsigned long) rq->special;1091 n = (unsigned long) rq->special;
1133 rq->special = (void *) --n;1092 rq->special = (void *) --n;