4 files changed, 28 insertions, 45 deletions

diff --git a/block/blk-core.c b/block/blk-core.c
index 29bcfac6c688..996ed906d8ca 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -603,13 +603,10 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
         q->queue_flags          = QUEUE_FLAG_DEFAULT;
         q->queue_lock           = lock;
 
-        blk_queue_segment_boundary(q, BLK_SEG_BOUNDARY_MASK);
-
+        /*
+         * This also sets hw/phys segments, boundary and size
+         */
         blk_queue_make_request(q, __make_request);
-        blk_queue_max_segment_size(q, MAX_SEGMENT_SIZE);
-
-        blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);
-        blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);
 
         q->sg_reserved_size = INT_MAX;
 
@@ -735,7 +732,6 @@ static void freed_request(struct request_queue *q, int rw, int priv)
                 __freed_request(q, rw ^ 1);
 }
 
-#define blkdev_free_rq(list) list_entry((list)->next, struct request, queuelist)
 /*
  * Get a free request, queue_lock must be held.
  * Returns NULL on failure, with queue_lock held.
@@ -1066,6 +1062,9 @@ void __blk_put_request(struct request_queue *q, struct request *req)
 
         elv_completed_request(q, req);
 
+        /* this is a bio leak */
+        WARN_ON(req->bio != NULL);
+
         /*
          * Request may not have originated from ll_rw_blk. if not,
          * it didn't come out of our reserved rq pools
diff --git a/block/blk-merge.c b/block/blk-merge.c
index a104593e70c3..e39cb24b7679 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -39,14 +39,13 @@ void blk_recalc_rq_sectors(struct request *rq, int nsect)
 }
 
 static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
-                                             struct bio *bio,
-                                             unsigned int *seg_size_ptr)
+                                             struct bio *bio)
 {
         unsigned int phys_size;
         struct bio_vec *bv, *bvprv = NULL;
         int cluster, i, high, highprv = 1;
         unsigned int seg_size, nr_phys_segs;
-        struct bio *fbio;
+        struct bio *fbio, *bbio;
 
         if (!bio)
                 return 0;
@@ -87,26 +86,20 @@ new_segment:
                         seg_size = bv->bv_len;
                         highprv = high;
                 }
+                bbio = bio;
         }
 
-        if (seg_size_ptr)
-                *seg_size_ptr = seg_size;
+        if (nr_phys_segs == 1 && seg_size > fbio->bi_seg_front_size)
+                fbio->bi_seg_front_size = seg_size;
+        if (seg_size > bbio->bi_seg_back_size)
+                bbio->bi_seg_back_size = seg_size;
 
         return nr_phys_segs;
 }
 
 void blk_recalc_rq_segments(struct request *rq)
 {
-        unsigned int seg_size = 0, phys_segs;
-
-        phys_segs = __blk_recalc_rq_segments(rq->q, rq->bio, &seg_size);
-
-        if (phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
-                rq->bio->bi_seg_front_size = seg_size;
-        if (seg_size > rq->biotail->bi_seg_back_size)
-                rq->biotail->bi_seg_back_size = seg_size;
-
-        rq->nr_phys_segments = phys_segs;
+        rq->nr_phys_segments = __blk_recalc_rq_segments(rq->q, rq->bio);
 }
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
@@ -114,7 +107,7 @@ void blk_recount_segments(struct request_queue *q, struct bio *bio)
         struct bio *nxt = bio->bi_next;
 
         bio->bi_next = NULL;
-        bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio, NULL);
+        bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio);
         bio->bi_next = nxt;
         bio->bi_flags |= (1 << BIO_SEG_VALID);
 }
@@ -410,6 +403,8 @@ static int attempt_merge(struct request_queue *q, struct request *req,
         if (blk_rq_cpu_valid(next))
                 req->cpu = next->cpu;
 
+        /* owner-ship of bio passed from next to req */
+        next->bio = NULL;
         __blk_put_request(q, next);
         return 1;
 }
diff --git a/block/bsg.c b/block/bsg.c
index 0ce8806dd0c1..206060e795da 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -218,9 +218,6 @@ bsg_validate_sgv4_hdr(struct request_queue *q, struct sg_io_v4 *hdr, int *rw)
 
         if (hdr->guard != 'Q')
                 return -EINVAL;
-        if (hdr->dout_xfer_len > (q->max_sectors << 9) ||
-            hdr->din_xfer_len > (q->max_sectors << 9))
-                return -EIO;
 
         switch (hdr->protocol) {
         case BSG_PROTOCOL_SCSI:
@@ -353,6 +350,8 @@ static void bsg_rq_end_io(struct request *rq, int uptodate)
 static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
                             struct bsg_command *bc, struct request *rq)
 {
+        int at_head = (0 == (bc->hdr.flags & BSG_FLAG_Q_AT_TAIL));
+
         /*
          * add bc command to busy queue and submit rq for io
          */
@@ -368,7 +367,7 @@ static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
         dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc);
 
         rq->end_io_data = bc;
-        blk_execute_rq_nowait(q, NULL, rq, 1, bsg_rq_end_io);
+        blk_execute_rq_nowait(q, NULL, rq, at_head, bsg_rq_end_io);
 }
 
 static struct bsg_command *bsg_next_done_cmd(struct bsg_device *bd)
@@ -924,6 +923,7 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 struct request *rq;
                 struct bio *bio, *bidi_bio = NULL;
                 struct sg_io_v4 hdr;
+                int at_head;
                 u8 sense[SCSI_SENSE_BUFFERSIZE];
 
                 if (copy_from_user(&hdr, uarg, sizeof(hdr)))
@@ -936,7 +936,9 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 bio = rq->bio;
                 if (rq->next_rq)
                         bidi_bio = rq->next_rq->bio;
-                blk_execute_rq(bd->queue, NULL, rq, 0);
+
+                at_head = (0 == (hdr.flags & BSG_FLAG_Q_AT_TAIL));
+                blk_execute_rq(bd->queue, NULL, rq, at_head);
                 ret = blk_complete_sgv4_hdr_rq(rq, &hdr, bio, bidi_bio);
 
                 if (copy_to_user(uarg, &hdr, sizeof(hdr)))
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index ee9c67d7e1be..626ee274c5c4 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -214,21 +214,10 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
         return 0;
 }
 
-/*
- * unmap a request that was previously mapped to this sg_io_hdr. handles
- * both sg and non-sg sg_io_hdr.
- */
-static int blk_unmap_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr)
-{
-        blk_rq_unmap_user(rq->bio);
-        blk_put_request(rq);
-        return 0;
-}
-
 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                                  struct bio *bio)
 {
-        int r, ret = 0;
+        int ret = 0;
 
         /*
          * fill in all the output members
@@ -253,12 +242,10 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
                         ret = -EFAULT;
         }
 
-        rq->bio = bio;
-        r = blk_unmap_sghdr_rq(rq, hdr);
-        if (ret)
-                r = ret;
+        blk_rq_unmap_user(bio);
+        blk_put_request(rq);
 
-        return r;
+        return ret;
 }
 
 static int sg_io(struct request_queue *q, struct gendisk *bd_disk,