Merge branch 'for-linus' of git://git.kernel.dk/linux-block

* 'for-linus' of git://git.kernel.dk/linux-block:
  block: Use hlist_entry() for io_context.cic_list.first
  cfq-iosched: Remove bogus check in queue_fail path
  xen/blkback: potential null dereference in error handling
  xen/blkback: don't call vbd_size() if bd_disk is NULL
  block: blkdev_get() should access ->bd_disk only after success
  CFQ: Fix typo and remove unnecessary semicolon
  block: remove unwanted semicolons
  Revert "block: Remove extra discard_alignment from hd_struct."
  nbd: adjust 'max_part' according to part_shift
  nbd: limit module parameters to a sane value
  nbd: pass MSG_* flags to kernel_recvmsg()
  block: improve the bio_add_page() and bio_add_pc_page() descriptions

3 files changed, 27 insertions, 8 deletions

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index e6fc716aca4..f533f3375e2 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -192,7 +192,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
                         if (lo->xmit_timeout)
                                 del_timer_sync(&ti);
                 } else
-                        result = kernel_recvmsg(sock, &msg, &iov, 1, size, 0);
+                        result = kernel_recvmsg(sock, &msg, &iov, 1, size,
+                                                msg.msg_flags);
 
                 if (signal_pending(current)) {
                         siginfo_t info;
@@ -753,9 +754,26 @@ static int __init nbd_init(void)
                 return -ENOMEM;
 
         part_shift = 0;
-        if (max_part > 0)
+        if (max_part > 0) {
                 part_shift = fls(max_part);
 
+                /*
+                 * Adjust max_part according to part_shift as it is exported
+                 * to user space so that user can know the max number of
+                 * partition kernel should be able to manage.
+                 *
+                 * Note that -1 is required because partition 0 is reserved
+                 * for the whole disk.
+                 */
+                max_part = (1UL << part_shift) - 1;
+        }
+
+        if ((1UL << part_shift) > DISK_MAX_PARTS)
+                return -EINVAL;
+
+        if (nbds_max > 1UL << (MINORBITS - part_shift))
+                return -EINVAL;
+
         for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = alloc_disk(1 << part_shift);
                 if (!disk)
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index c73910cc28c..5cf2993a833 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -809,11 +809,13 @@ static int __init xen_blkif_init(void)
  failed_init:
         kfree(blkbk->pending_reqs);
         kfree(blkbk->pending_grant_handles);
-        for (i = 0; i < mmap_pages; i++) {
-                if (blkbk->pending_pages[i])
-                        __free_page(blkbk->pending_pages[i]);
+        if (blkbk->pending_pages) {
+                for (i = 0; i < mmap_pages; i++) {
+                        if (blkbk->pending_pages[i])
+                                __free_page(blkbk->pending_pages[i]);
+                }
+                kfree(blkbk->pending_pages);
         }
-        kfree(blkbk->pending_pages);
         kfree(blkbk);
         blkbk = NULL;
         return rc;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 34570823355..6cc0db1bf52 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -357,14 +357,13 @@ static int xen_vbd_create(struct xen_blkif *blkif, blkif_vdev_t handle,
         }
 
         vbd->bdev = bdev;
-        vbd->size = vbd_sz(vbd);
-
         if (vbd->bdev->bd_disk == NULL) {
                 DPRINTK("xen_vbd_create: device %08x doesn't exist.\n",
                         vbd->pdevice);
                 xen_vbd_free(vbd);
                 return -ENOENT;
         }
+        vbd->size = vbd_sz(vbd);
 
         if (vbd->bdev->bd_disk->flags & GENHD_FL_CD || cdrom)
                 vbd->type |= VDISK_CDROM;