releases/4.8.16/aoe-fix-crash-in-page-count-manipulation.patch

   1 From 0cbc72a1781250f373327dd7e306e33859a42154 Mon Sep 17 00:00:00 2001
   2 From: Jens Axboe <axboe@fb.com>
   3 Date: Fri, 11 Nov 2016 18:28:50 -0700
   4 Subject: aoe: fix crash in page count manipulation
   5
   6 From: Jens Axboe <axboe@fb.com>
   7
   8 commit 0cbc72a1781250f373327dd7e306e33859a42154 upstream.
   9
  10 aoeblk contains some mysterious code, that wants to elevate the bio
  11 vec page counts while it's under IO. That is not needed, it's
  12 fragile, and it's causing kernel oopses for some.
  13
  14 Reported-by: Tested-by: Don Koch <kochd@us.ibm.com>
  15 Tested-by: Tested-by: Don Koch <kochd@us.ibm.com>
  16 Signed-off-by: Jens Axboe <axboe@fb.com>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/block/aoe/aoecmd.c |   41 -----------------------------------------
  21  1 file changed, 41 deletions(-)
  22
  23 --- a/drivers/block/aoe/aoecmd.c
  24 +++ b/drivers/block/aoe/aoecmd.c
  25 @@ -853,45 +853,6 @@ rqbiocnt(struct request *r)
  26         return n;
  27  }
  28
  29 -/* This can be removed if we are certain that no users of the block
  30 - * layer will ever use zero-count pages in bios.  Otherwise we have to
  31 - * protect against the put_page sometimes done by the network layer.
  32 - *
  33 - * See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for
  34 - * discussion.
  35 - *
  36 - * We cannot use get_page in the workaround, because it insists on a
  37 - * positive page count as a precondition.  So we use _refcount directly.
  38 - */
  39 -static void
  40 -bio_pageinc(struct bio *bio)
  41 -{
  42 -       struct bio_vec bv;
  43 -       struct page *page;
  44 -       struct bvec_iter iter;
  45 -
  46 -       bio_for_each_segment(bv, bio, iter) {
  47 -               /* Non-zero page count for non-head members of
  48 -                * compound pages is no longer allowed by the kernel.
  49 -                */
  50 -               page = compound_head(bv.bv_page);
  51 -               page_ref_inc(page);
  52 -       }
  53 -}
  54 -
  55 -static void
  56 -bio_pagedec(struct bio *bio)
  57 -{
  58 -       struct page *page;
  59 -       struct bio_vec bv;
  60 -       struct bvec_iter iter;
  61 -
  62 -       bio_for_each_segment(bv, bio, iter) {
  63 -               page = compound_head(bv.bv_page);
  64 -               page_ref_dec(page);
  65 -       }
  66 -}
  67 -
  68  static void
  69  bufinit(struct buf *buf, struct request *rq, struct bio *bio)
  70  {
  71 @@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request
  72         buf->rq = rq;
  73         buf->bio = bio;
  74         buf->iter = bio->bi_iter;
  75 -       bio_pageinc(bio);
  76  }
  77
  78  static struct buf *
  79 @@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct buf
  80         if (buf == d->ip.buf)
  81                 d->ip.buf = NULL;
  82         rq = buf->rq;
  83 -       bio_pagedec(buf->bio);
  84         mempool_free(buf, d->bufpool);
  85         n = (unsigned long) rq->special;
  86         rq->special = (void *) --n;