From: Christophe Saout We need to call clone_init as early as possible - at least before call bio_put(clone) in any error path. Otherwise, the destructor will try to dereference bi_private, which may still be NULL. Signed-off-by: Olaf Kirch Acked-by: Christophe Saout Cc: Alasdair G Kergon Signed-off-by: Andrew Morton --- drivers/md/dm-crypt.c | 12 +++++++----- 1 files changed, 7 insertions(+), 5 deletions(-) Index: linux-2.6.21-rc5/drivers/md/dm-crypt.c =================================================================== --- linux-2.6.21-rc5.orig/drivers/md/dm-crypt.c 2007-04-03 17:10:47.000000000 +0100 +++ linux-2.6.21-rc5/drivers/md/dm-crypt.c 2007-04-03 17:13:56.000000000 +0100 @@ -107,6 +107,8 @@ struct crypt_config { static struct kmem_cache *_crypt_io_pool; +static void clone_init(struct crypt_io *, struct bio *); + /* * Different IV generation algorithms: * @@ -393,9 +395,10 @@ static int crypt_convert(struct crypt_co * May return a smaller bio when running out of pages */ static struct bio * -crypt_alloc_buffer(struct crypt_config *cc, unsigned int size, +crypt_alloc_buffer(struct crypt_io *io, unsigned int size, struct bio *base_bio, unsigned int *bio_vec_idx) { + struct crypt_config *cc = io->target->private; struct bio *clone; unsigned int nr_iovecs = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; gfp_t gfp_mask = GFP_NOIO | __GFP_HIGHMEM; @@ -410,7 +413,7 @@ crypt_alloc_buffer(struct crypt_config * if (!clone) return NULL; - clone->bi_destructor = dm_crypt_bio_destructor; + clone_init(io, clone); /* if the last bio was not complete, continue where that one ended */ clone->bi_idx = *bio_vec_idx; @@ -576,6 +579,7 @@ static void clone_init(struct crypt_io * clone->bi_end_io = crypt_endio; clone->bi_bdev = cc->dev->bdev; clone->bi_rw = io->base_bio->bi_rw; + clone->bi_destructor = dm_crypt_bio_destructor; } static void process_read(struct crypt_io *io) @@ -599,7 +603,6 @@ static void process_read(struct crypt_io } clone_init(io, clone); - clone->bi_destructor = dm_crypt_bio_destructor; clone->bi_idx = 0; clone->bi_vcnt = bio_segments(base_bio); clone->bi_size = base_bio->bi_size; @@ -629,7 +632,7 @@ static void process_write(struct crypt_i * so repeat the whole process until all the data can be handled. */ while (remaining) { - clone = crypt_alloc_buffer(cc, base_bio->bi_size, + clone = crypt_alloc_buffer(io, base_bio->bi_size, io->first_clone, &bvec_idx); if (unlikely(!clone)) { dec_pending(io, -ENOMEM); @@ -645,7 +648,6 @@ static void process_write(struct crypt_i return; } - clone_init(io, clone); clone->bi_sector = cc->start + sector; if (!io->first_clone) {