4 files changed, 19 insertions, 17 deletions

diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index a66ec30855d8..e07c079e07e6 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -2405,6 +2405,7 @@ int blk_rq_map_user(request_queue_t *q, struct request *rq, void __user *ubuf,
                     unsigned long len)
 {
         unsigned long bytes_read = 0;
+        struct bio *bio = NULL;
         int ret;
 
         if (len > (q->max_hw_sectors << 9))
@@ -2431,6 +2432,8 @@ int blk_rq_map_user(request_queue_t *q, struct request *rq, void __user *ubuf,
                 ret = __blk_rq_map_user(q, rq, ubuf, map_len);
                 if (ret < 0)
                         goto unmap_rq;
+                if (!bio)
+                        bio = rq->bio;
                 bytes_read += ret;
                 ubuf += ret;
         }
@@ -2438,7 +2441,7 @@ int blk_rq_map_user(request_queue_t *q, struct request *rq, void __user *ubuf,
         rq->buffer = rq->data = NULL;
         return 0;
 unmap_rq:
-        blk_rq_unmap_user(rq);
+        blk_rq_unmap_user(bio);
         return ret;
 }
 
@@ -2495,29 +2498,30 @@ EXPORT_SYMBOL(blk_rq_map_user_iov);
 
 /**
  * blk_rq_unmap_user - unmap a request with user data
- * @rq:         rq to be unmapped
+ * @bio:               start of bio list
  *
  * Description:
- *    Unmap a rq previously mapped by blk_rq_map_user().
- *    rq->bio must be set to the original head of the request.
+ *    Unmap a rq previously mapped by blk_rq_map_user(). The caller must
+ *    supply the original rq->bio from the blk_rq_map_user() return, since
+ *    the io completion may have changed rq->bio.
  */
-int blk_rq_unmap_user(struct request *rq)
+int blk_rq_unmap_user(struct bio *bio)
 {
-        struct bio *bio, *mapped_bio;
+        struct bio *mapped_bio;
         int ret = 0, ret2;
 
-        while ((bio = rq->bio)) {
-                if (bio_flagged(bio, BIO_BOUNCED))
+        while (bio) {
+                mapped_bio = bio;
+                if (unlikely(bio_flagged(bio, BIO_BOUNCED)))
                         mapped_bio = bio->bi_private;
-                else
-                        mapped_bio = bio;
 
                 ret2 = __blk_rq_unmap_user(mapped_bio);
                 if (ret2 && !ret)
                         ret = ret2;
 
-                rq->bio = bio->bi_next;
-                bio_put(bio);
+                mapped_bio = bio;
+                bio = bio->bi_next;
+                bio_put(mapped_bio);
         }
 
         return ret;
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index f322b6a441d8..2528a0c0dec8 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -333,8 +333,7 @@ static int sg_io(struct file *file, request_queue_t *q,
                         hdr->sb_len_wr = len;
         }
 
-        rq->bio = bio;
-        if (blk_rq_unmap_user(rq))
+        if (blk_rq_unmap_user(bio))
                 ret = -EFAULT;
 
         /* may not have succeeded, but output values written to control
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index e4a2f8f3a1d7..66d028d30439 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2139,8 +2139,7 @@ static int cdrom_read_cdda_bpc(struct cdrom_device_info *cdi, __u8 __user *ubuf,
                         cdi->last_sense = s->sense_key;
                 }
 
-                rq->bio = bio;
-                if (blk_rq_unmap_user(rq))
+                if (blk_rq_unmap_user(bio))
                         ret = -EFAULT;
 
                 if (ret)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0fa33017ec02..36a6eacefe20 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -672,7 +672,7 @@ extern void __blk_stop_queue(request_queue_t *q);
 extern void blk_run_queue(request_queue_t *);
 extern void blk_start_queueing(request_queue_t *);
 extern int blk_rq_map_user(request_queue_t *, struct request *, void __user *, unsigned long);
-extern int blk_rq_unmap_user(struct request *);
+extern int blk_rq_unmap_user(struct bio *);
 extern int blk_rq_map_kern(request_queue_t *, struct request *, void *, unsigned int, gfp_t);
 extern int blk_rq_map_user_iov(request_queue_t *, struct request *,
                                struct sg_iovec *, int, unsigned int);