block: WARN in __blk_put_request() for potential bio leak

Put a WARN_ON in __blk_put_request if it is about to
leak bio(s). This is a serious bug that can happen in error
handling code paths.

For this to work I have fixed a couple of places in block/ where
request->bio != NULL ownership was not honored. And a small cleanup
at sg_io() while at it.

Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

1 files changed, 4 insertions, 17 deletions

diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index ee9c67d7e1be..626ee274c5c4 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -214,21 +214,10 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
         return 0;
 }
 
-/*
- * unmap a request that was previously mapped to this sg_io_hdr. handles
- * both sg and non-sg sg_io_hdr.
- */
-static int blk_unmap_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr)
-{
-        blk_rq_unmap_user(rq->bio);
-        blk_put_request(rq);
-        return 0;
-}
-
 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                                  struct bio *bio)
 {
-        int r, ret = 0;
+        int ret = 0;
 
         /*
          * fill in all the output members
@@ -253,12 +242,10 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                         ret = -EFAULT;
         }
 
-        rq->bio = bio;
-        r = blk_unmap_sghdr_rq(rq, hdr);
-        if (ret)
-                r = ret;
+        blk_rq_unmap_user(bio);
+        blk_put_request(rq);
 
-        return r;
+        return ret;
 }
 
 static int sg_io(struct request_queue *q, struct gendisk *bd_disk,