block, direct-io: fix OOM by converting to bio_for_each_page_all()

There has been an occasional out-of-memory problem with multipage bvecs.

Fix the bug by converting bio_for_each_segment_all() to
bio_for_each_page_all(), both in bio_check_pages_dirty() and
dio_bio_complete().

To reproduce the OOM, run xfstests/generic/113 infinitely:

while [ 1 ] ; do
	./check generic/113
done

TODO: audit other uses of bio_for_each_segment_all()

Signed-off-by: Ming Lin <mlin@minggr.net>
[dpark: add more description into commit message]
Signed-off-by: Dongsu Park <dongsu.park@profitbricks.com>
block: convert to bio_for_each_page_all also in __bio_unmap_user()

Replace bio_for_each_segment_all() with bio_for_each_page_all(),
also in __bio_unmap_user(). Follow-up of commit 160e570ce.
Without this fix, page_cache_release() sometimes causes kernel to
crash like this:

BUG: Bad page state in process kworker/1:7  pfn:74322 page:ffffea0001d0c880
count:0 mapcount:1 mapping:          (null) index:0x7f0108bfb
flags: page dumped because: nonzero mapcount
CPU: 1 PID: 3795 Comm: kworker/1:7 Tainted: G W 3.19.0-rc1+ #87
Workqueue: events bio_dirty_fn
 ffffffff81c53428 ffff880077e5bbf8 ffffffff818004a6 ffff88007d1cf278
 ffffea0001d0c880 ffff880077e5bc28 ffffffff811b114c ffff880077e5bc28
 ffffea0001d0c880 ffffea0001d0c880 0000000000000000 ffff880077e5bc88
Call Trace:
 [<ffffffff818004a6>] dump_stack+0x4c/0x65
 [<ffffffff811b114c>] bad_page.part.57+0xbc/0x110
 [<ffffffff811b1d11>] free_pages_prepare+0x231/0x400
 [<ffffffff811b47f5>] free_hot_cold_page+0x35/0x1b0
 [<ffffffff811bc4b6>] ? __page_cache_release+0xf6/0x170
 [<ffffffff811bd1ef>] put_page+0x3f/0x70
 [<ffffffff814e5056>] bio_dirty_fn+0x76/0xa0
 [<ffffffff8109bd88>] process_one_work+0x1e8/0x7f0
 [<ffffffff8109bcfd>] ? process_one_work+0x15d/0x7f0
 [<ffffffff8109c48b>] ? worker_thread+0xfb/0x4b0
 [<ffffffff8109c3fb>] worker_thread+0x6b/0x4b0
 [<ffffffff8109c390>] ? process_one_work+0x7f0/0x7f0
 [<ffffffff810a232d>] kthread+0x10d/0x130
 [<ffffffff810d509d>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff810a2220>] ? kthread_create_on_node+0x230/0x230
 [<ffffffff8180a1ec>] ret_from_fork+0x7c/0xb0
 [<ffffffff810a2220>] ? kthread_create_on_node+0x230/0x230

Signed-off-by: Dongsu Park <dongsu.park@profitbricks.com>
block: check nsegs before bv_len in blk_bio_segment_split()

We should check "nsegs == queue_max_segments(q)" first
in blk_bio_segment_split(). Otherwise, if "bv.bv_len > remaining"
is also true, then the iterator will advance once more, that actually
makes "nsegs" be queue_max_segments()+1. So trigger the BUG_ON in
virtio_queue_rq()

BUG_ON(req->nr_phys_segments + 2 > vblk->sg_elems);

To reproduce it, run xfstests/generic/113 infinitely:

while [ 1 ] ; do
  ./check generic/113
done

Signed-off-by: Ming Lin <mlin@minggr.net>
[dpark: change commit messsage]
Signed-off-by: Dongsu Park <dongsu.park@profitbricks.com>