Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block

* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
  bio: fix memcpy corruption in bio_copy_user_iov()
  hd: fix locking
  mg_disk: fix CONFIG_LBD=y warning
  mg_disk: fix locking

3 files changed, 24 insertions, 15 deletions

diff --git a/drivers/block/hd.c b/drivers/block/hd.c
index 3c11f062a18c..baaa9e486e50 100644
--- a/drivers/block/hd.c
+++ b/drivers/block/hd.c
@@ -509,7 +509,6 @@ ok_to_write:
         if (i > 0) {
                 SET_HANDLER(&write_intr);
                 outsw(HD_DATA, req->buffer, 256);
-                local_irq_enable();
         } else {
 #if (HD_DELAY > 0)
                 last_req = read_timer();
@@ -541,8 +540,7 @@ static void hd_times_out(unsigned long dummy)
         if (!CURRENT)
                 return;
 
-        disable_irq(HD_IRQ);
-        local_irq_enable();
+        spin_lock_irq(hd_queue->queue_lock);
         reset = 1;
         name = CURRENT->rq_disk->disk_name;
         printk("%s: timeout\n", name);
@@ -552,9 +550,8 @@ static void hd_times_out(unsigned long dummy)
 #endif
                 end_request(CURRENT, 0);
         }
-        local_irq_disable();
         hd_request();
-        enable_irq(HD_IRQ);
+        spin_unlock_irq(hd_queue->queue_lock);
 }
 
 static int do_special_op(struct hd_i_struct *disk, struct request *req)
@@ -592,7 +589,6 @@ static void hd_request(void)
                 return;
 repeat:
         del_timer(&device_timer);
-        local_irq_enable();
 
         req = CURRENT;
         if (!req) {
@@ -601,7 +597,6 @@ repeat:
         }
 
         if (reset) {
-                local_irq_disable();
                 reset_hd();
                 return;
         }
@@ -660,9 +655,7 @@ repeat:
 
 static void do_hd_request(struct request_queue *q)
 {
-        disable_irq(HD_IRQ);
         hd_request();
-        enable_irq(HD_IRQ);
 }
 
 static int hd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
@@ -684,12 +677,16 @@ static irqreturn_t hd_interrupt(int irq, void *dev_id)
 {
         void (*handler)(void) = do_hd;
 
+        spin_lock(hd_queue->queue_lock);
+
         do_hd = NULL;
         del_timer(&device_timer);
         if (!handler)
                 handler = unexpected_hd_interrupt;
         handler();
-        local_irq_enable();
+
+        spin_unlock(hd_queue->queue_lock);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/block/mg_disk.c b/drivers/block/mg_disk.c
index fb39d9aa3cdc..f3898353d0a8 100644
--- a/drivers/block/mg_disk.c
+++ b/drivers/block/mg_disk.c
@@ -79,7 +79,7 @@ static void mg_dump_status(const char *msg, unsigned int stat,
                         if (host->breq) {
                                 req = elv_next_request(host->breq);
                                 if (req)
-                                        printk(", sector=%ld", req->sector);
+                                        printk(", sector=%u", (u32)req->sector);
                         }
 
                 }
@@ -160,11 +160,16 @@ static irqreturn_t mg_irq(int irq, void *dev_id)
         struct mg_host *host = dev_id;
         void (*handler)(struct mg_host *) = host->mg_do_intr;
 
-        host->mg_do_intr = 0;
+        spin_lock(&host->lock);
+
+        host->mg_do_intr = NULL;
         del_timer(&host->timer);
         if (!handler)
                 handler = mg_unexpected_intr;
         handler(host);
+
+        spin_unlock(&host->lock);
+
         return IRQ_HANDLED;
 }
 
@@ -319,7 +324,7 @@ static void mg_read(struct request *req)
 
         remains = req->nr_sectors;
 
-        if (mg_out(host, req->sector, req->nr_sectors, MG_CMD_RD, 0) !=
+        if (mg_out(host, req->sector, req->nr_sectors, MG_CMD_RD, NULL) !=
                         MG_ERR_NONE)
                 mg_bad_rw_intr(host);
 
@@ -363,7 +368,7 @@ static void mg_write(struct request *req)
 
         remains = req->nr_sectors;
 
-        if (mg_out(host, req->sector, req->nr_sectors, MG_CMD_WR, 0) !=
+        if (mg_out(host, req->sector, req->nr_sectors, MG_CMD_WR, NULL) !=
                         MG_ERR_NONE) {
                 mg_bad_rw_intr(host);
                 return;
@@ -521,9 +526,11 @@ void mg_times_out(unsigned long data)
         char *name;
         struct request *req;
 
+        spin_lock_irq(&host->lock);
+
         req = elv_next_request(host->breq);
         if (!req)
-                return;
+                goto out_unlock;
 
         host->mg_do_intr = NULL;
 
@@ -534,6 +541,8 @@ void mg_times_out(unsigned long data)
         mg_bad_rw_intr(host);
 
         mg_request(host->breq);
+out_unlock:
+        spin_unlock_irq(&host->lock);
 }
 
 static void mg_request_poll(struct request_queue *q)
diff --git a/fs/bio.c b/fs/bio.c
index 7bbc98f0eda1..98711647ece4 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                 len += iov[i].iov_len;
         }
 
+        if (offset)
+                nr_pages++;
+
         bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
         if (!bmd)
                 return ERR_PTR(-ENOMEM);