5 files changed, 20 insertions, 29 deletions

diff --git a/block/blk-core.c b/block/blk-core.c
index 29bcfac6c688..996ed906d8ca 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -603,13 +603,10 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
         q->queue_flags          = QUEUE_FLAG_DEFAULT;
         q->queue_lock           = lock;
 
-        blk_queue_segment_boundary(q, BLK_SEG_BOUNDARY_MASK);
-
+        /*
+         * This also sets hw/phys segments, boundary and size
+         */
         blk_queue_make_request(q, __make_request);
-        blk_queue_max_segment_size(q, MAX_SEGMENT_SIZE);
-
-        blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);
-        blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);
 
         q->sg_reserved_size = INT_MAX;
 
@@ -735,7 +732,6 @@ static void freed_request(struct request_queue *q, int rw, int priv)
                 __freed_request(q, rw ^ 1);
 }
 
-#define blkdev_free_rq(list) list_entry((list)->next, struct request, queuelist)
 /*
  * Get a free request, queue_lock must be held.
  * Returns NULL on failure, with queue_lock held.
@@ -1066,6 +1062,9 @@ void __blk_put_request(struct request_queue *q, struct request *req)
 
         elv_completed_request(q, req);
 
+        /* this is a bio leak */
+        WARN_ON(req->bio != NULL);
+
         /*
          * Request may not have originated from ll_rw_blk. if not,
          * it didn't come out of our reserved rq pools
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 5a244f05360f..e39cb24b7679 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -403,6 +403,8 @@ static int attempt_merge(struct request_queue *q, struct request *req,
         if (blk_rq_cpu_valid(next))
                 req->cpu = next->cpu;
 
+        /* owner-ship of bio passed from next to req */
+        next->bio = NULL;
         __blk_put_request(q, next);
         return 1;
 }
diff --git a/block/bsg.c b/block/bsg.c
index 0ce8806dd0c1..206060e795da 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -218,9 +218,6 @@ bsg_validate_sgv4_hdr(struct request_queue *q, struct sg_io_v4 *hdr, int *rw)
 
         if (hdr->guard != 'Q')
                 return -EINVAL;
-        if (hdr->dout_xfer_len > (q->max_sectors << 9) ||
-            hdr->din_xfer_len > (q->max_sectors << 9))
-                return -EIO;
 
         switch (hdr->protocol) {
         case BSG_PROTOCOL_SCSI:
@@ -353,6 +350,8 @@ static void bsg_rq_end_io(struct request *rq, int uptodate)
 static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
                             struct bsg_command *bc, struct request *rq)
 {
+        int at_head = (0 == (bc->hdr.flags & BSG_FLAG_Q_AT_TAIL));
+
         /*
          * add bc command to busy queue and submit rq for io
          */
@@ -368,7 +367,7 @@ static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
         dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc);
 
         rq->end_io_data = bc;
-        blk_execute_rq_nowait(q, NULL, rq, 1, bsg_rq_end_io);
+        blk_execute_rq_nowait(q, NULL, rq, at_head, bsg_rq_end_io);
 }
 
 static struct bsg_command *bsg_next_done_cmd(struct bsg_device *bd)
@@ -924,6 +923,7 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 struct request *rq;
                 struct bio *bio, *bidi_bio = NULL;
                 struct sg_io_v4 hdr;
+                int at_head;
                 u8 sense[SCSI_SENSE_BUFFERSIZE];
 
                 if (copy_from_user(&hdr, uarg, sizeof(hdr)))
@@ -936,7 +936,9 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 bio = rq->bio;
                 if (rq->next_rq)
                         bidi_bio = rq->next_rq->bio;
-                blk_execute_rq(bd->queue, NULL, rq, 0);
+
+                at_head = (0 == (hdr.flags & BSG_FLAG_Q_AT_TAIL));
+                blk_execute_rq(bd->queue, NULL, rq, at_head);
                 ret = blk_complete_sgv4_hdr_rq(rq, &hdr, bio, bidi_bio);
 
                 if (copy_to_user(uarg, &hdr, sizeof(hdr)))
diff --git a/block/cmd-filter.c b/block/cmd-filter.c
index 504b275e1b90..572bbc2f900d 100644
--- a/block/cmd-filter.c
+++ b/block/cmd-filter.c
@@ -22,6 +22,7 @@
 #include <linux/spinlock.h>
 #include <linux/capability.h>
 #include <linux/bitops.h>
+#include <linux/blkdev.h>
 
 #include <scsi/scsi.h>
 #include <linux/cdrom.h>
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index ee9c67d7e1be..626ee274c5c4 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -214,21 +214,10 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
         return 0;
 }
 
-/*
- * unmap a request that was previously mapped to this sg_io_hdr. handles
- * both sg and non-sg sg_io_hdr.
- */
-static int blk_unmap_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr)
-{
-        blk_rq_unmap_user(rq->bio);
-        blk_put_request(rq);
-        return 0;
-}
-
 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                                  struct bio *bio)
 {
-        int r, ret = 0;
+        int ret = 0;
 
         /*
          * fill in all the output members
@@ -253,12 +242,10 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                         ret = -EFAULT;
         }
 
-        rq->bio = bio;
-        r = blk_unmap_sghdr_rq(rq, hdr);
-        if (ret)
-                r = ret;
+        blk_rq_unmap_user(bio);
+        blk_put_request(rq);
 
-        return r;
+        return ret;
 }
 
 static int sg_io(struct request_queue *q, struct gendisk *bd_disk,