When block layer fails to map iov, it calls bio_unmap_user to undo mapping. Which is good if pages were mapped - but if they were provided by someone else and just copied then bad things happen - pages are released once here, and once by caller, leading to user triggerable BUG at include/linux/mm.h:246.

Signed-off-by: Petr Vandrovec <[e-mail]>
Signed-off-by: Jens Axboe <[e-mail]>

block/blk-map.c

···
 		 */
 		bio_get(bio);
 		bio_endio(bio, 0);
-		bio_unmap_user(bio);
+		__blk_rq_unmap_user(bio);
 		return -EINVAL;
 	}