summaryrefslogtreecommitdiffstats
path: root/block/bounce.c
diff options
context:
space:
mode:
authorMing Lei <ming.lei@canonical.com>2015-09-18 00:06:28 +0800
committerJens Axboe <axboe@fb.com>2015-09-17 10:07:04 -0600
commit994518799930fc363d47cb7cf0d1abed1790bf16 (patch)
tree419b2187d773572e67ae96c06b56d3e571f34307 /block/bounce.c
parent52cc6eead9095e2faf2ec7afc013aa3af1f01ac5 (diff)
downloadlinux-stable-994518799930fc363d47cb7cf0d1abed1790bf16.tar.gz
linux-stable-994518799930fc363d47cb7cf0d1abed1790bf16.tar.bz2
linux-stable-994518799930fc363d47cb7cf0d1abed1790bf16.zip
block: fix bounce_end_io
When bio bounce is involved, one new bio and its biovecs are cloned from the comming bio, which can be one fast-cloned bio from upper layer(such as dm). So it is obviously wrong to assume the start index of the coming( original) bio's io vector is zero, which can be any value between 0 and (bi_max_vecs - 1), especially in case of bio split. This patch fixes Fedora's booting oops on i386, often with the following kernel log together: > [ 9.026738] systemd[1]: Switching root. > [ 9.036467] systemd-journald[149]: Received SIGTERM from PID 1 > (systemd). > [ 9.082262] BUG: Bad page state in process kworker/u5:1 pfn:372ac > [ 9.083989] page:f3d32ae0 count:0 mapcount:0 mapping:f2252178 > index:0x16a > [ 9.085755] flags: 0x40020021(locked|lru|mappedtodisk) > [ 9.087284] page dumped because: page still charged to cgroup > [ 9.088772] bad because of flags: > [ 9.089731] flags: 0x21(locked|lru) > [ 9.090818] page->mem_cgroup:f2c3e400 Reported-by: Josh Boyer <jwboyer@fedoraproject.org> Tested-by: Adam Williamson <awilliam@redhat.com> Cc: Ming Lin <mlin@kernel.org> Cc: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block/bounce.c')
-rw-r--r--block/bounce.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/block/bounce.c b/block/bounce.c
index 2c310ea007ee..457ebd57542f 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -128,12 +128,14 @@ static void bounce_end_io(struct bio *bio, mempool_t *pool)
struct bio *bio_orig = bio->bi_private;
struct bio_vec *bvec, *org_vec;
int i;
+ int start = bio_orig->bi_iter.bi_idx;
/*
* free up bounce indirect pages used
*/
bio_for_each_segment_all(bvec, bio, i) {
- org_vec = bio_orig->bi_io_vec + i;
+ org_vec = bio_orig->bi_io_vec + i + start;
+
if (bvec->bv_page == org_vec->bv_page)
continue;