Merge tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client

torvalds · torvalds · commit 3b3ce01a57ad · 2016-08-11T13:53:34.000-07:00
Pull ceph fixes from Ilya Dryomov: "A patch for a NULL dereference bug introduced in 4.8-rc1 and a handful of static checker fixes" * tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client: ceph: initialize pathbase in the !dentry case in encode_caps_cb() rbd: nuke the 32-bit pool id check rbd: destroy header_oloc in rbd_dev_release() ceph: fix null pointer dereference in ceph_flush_snaps() libceph: using kfree_rcu() to simplify the code libceph: make cancel_generic_request() static libceph: fix return value check in alloc_msg_with_page_vector()
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
@@ -3950,6 +3950,7 @@ static void rbd_dev_release(struct device *dev)
 	bool need_put = !!rbd_dev->opts;
 
 	ceph_oid_destroy(&rbd_dev->header_oid);
+	ceph_oloc_destroy(&rbd_dev->header_oloc);
 
 	rbd_put_client(rbd_dev->rbd_client);
 	rbd_spec_put(rbd_dev->spec);
@@ -5336,15 +5337,6 @@ static ssize_t do_rbd_add(struct bus_type *bus,
 	}
 	spec->pool_id = (u64)rc;
 
-	/* The ceph file layout needs to fit pool id in 32 bits */
-
-	if (spec->pool_id > (u64)U32_MAX) {
-		rbd_warn(NULL, "pool id too large (%llu > %u)",
-				(unsigned long long)spec->pool_id, U32_MAX);
-		rc = -EIO;
-		goto err_out_client;
-	}
-
 	rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts);
 	if (!rbd_dev) {
 		rc = -ENOMEM;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
@@ -1347,9 +1347,12 @@ void ceph_flush_snaps(struct ceph_inode_info *ci,
 {
 	struct inode *inode = &ci->vfs_inode;
 	struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
-	struct ceph_mds_session *session = *psession;
+	struct ceph_mds_session *session = NULL;
 	int mds;
+
 	dout("ceph_flush_snaps %p\n", inode);
+	if (psession)
+		session = *psession;
 retry:
 	spin_lock(&ci->i_ceph_lock);
 	if (!(ci->i_ceph_flags & CEPH_I_FLUSH_SNAPS)) {
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
@@ -2759,6 +2759,7 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
 	} else {
 		path = NULL;
 		pathlen = 0;
+		pathbase = 0;
 	}
 
 	spin_lock(&ci->i_ceph_lock);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
@@ -574,7 +574,7 @@ static void complete_generic_request(struct ceph_mon_generic_request *req)
 	put_generic_request(req);
 }
 
-void cancel_generic_request(struct ceph_mon_generic_request *req)
+static void cancel_generic_request(struct ceph_mon_generic_request *req)
 {
 	struct ceph_mon_client *monc = req->monc;
 	struct ceph_mon_generic_request *lookup_req;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
@@ -4220,7 +4220,7 @@ static struct ceph_msg *alloc_msg_with_page_vector(struct ceph_msg_header *hdr)
 
 		pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),
 					       GFP_NOIO);
-		if (!pages) {
+		if (IS_ERR(pages)) {
 			ceph_msg_put(m);
 			return NULL;
 		}
diff --git a/net/ceph/string_table.c b/net/ceph/string_table.c
@@ -84,12 +84,6 @@ struct ceph_string *ceph_find_or_create_string(const char* str, size_t len)
 }
 EXPORT_SYMBOL(ceph_find_or_create_string);
 
-static void ceph_free_string(struct rcu_head *head)
-{
-	struct ceph_string *cs = container_of(head, struct ceph_string, rcu);
-	kfree(cs);
-}
-
 void ceph_release_string(struct kref *ref)
 {
 	struct ceph_string *cs = container_of(ref, struct ceph_string, kref);
@@ -101,7 +95,7 @@ void ceph_release_string(struct kref *ref)
 	}
 	spin_unlock(&string_tree_lock);
 
-	call_rcu(&cs->rcu, ceph_free_string);
+	kfree_rcu(cs, rcu);
 }
 EXPORT_SYMBOL(ceph_release_string);
 

Original file line number	Diff line number	Diff line change
`@@ -2759,6 +2759,7 @@ static int encode_caps_cb(struct inode inode, struct ceph_cap cap,`
`2759`	`2759`	`} else {`
`2760`	`2760`	`path = NULL;`
`2761`	`2761`	`pathlen = 0;`
	`2762`	`+ pathbase = 0;`
`2762`	`2763`	`}`
`2763`	`2764`
`2764`	`2765`	`spin_lock(&ci->i_ceph_lock);`
Original file line number	Diff line number	Diff line change
`@@ -574,7 +574,7 @@ static void complete_generic_request(struct ceph_mon_generic_request *req)`
`574`	`574`	`put_generic_request(req);`
`575`	`575`	`}`
`576`	`576`
`577`		`-void cancel_generic_request(struct ceph_mon_generic_request *req)`
	`577`	`+static void cancel_generic_request(struct ceph_mon_generic_request *req)`
`578`	`578`	`{`
`579`	`579`	`struct ceph_mon_client *monc = req->monc;`
`580`	`580`	`struct ceph_mon_generic_request *lookup_req;`
Original file line number	Diff line number	Diff line change
`@@ -4220,7 +4220,7 @@ static struct ceph_msg alloc_msg_with_page_vector(struct ceph_msg_header hdr)`
`4220`	`4220`
`4221`	`4221`	`pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),`
`4222`	`4222`	`GFP_NOIO);`
`4223`		`- if (!pages) {`
	`4223`	`+ if (IS_ERR(pages)) {`
`4224`	`4224`	`ceph_msg_put(m);`
`4225`	`4225`	`return NULL;`
`4226`	`4226`	`}`
Original file line number	Diff line number	Diff line change
`@@ -84,12 +84,6 @@ struct ceph_string ceph_find_or_create_string(const char str, size_t len)`
`84`	`84`	`}`
`85`	`85`	`EXPORT_SYMBOL(ceph_find_or_create_string);`
`86`	`86`
`87`		`-static void ceph_free_string(struct rcu_head *head)`
`88`		`-{`
`89`		`- struct ceph_string *cs = container_of(head, struct ceph_string, rcu);`
`90`		`- kfree(cs);`
`91`		`-}`
`92`		`-`
`93`	`87`	`void ceph_release_string(struct kref *ref)`
`94`	`88`	`{`
`95`	`89`	`struct ceph_string *cs = container_of(ref, struct ceph_string, kref);`
`@@ -101,7 +95,7 @@ void ceph_release_string(struct kref *ref)`
`101`	`95`	`}`
`102`	`96`	`spin_unlock(&string_tree_lock);`
`103`	`97`
`104`		`- call_rcu(&cs->rcu, ceph_free_string);`
	`98`	`+ kfree_rcu(cs, rcu);`
`105`	`99`	`}`
`106`	`100`	`EXPORT_SYMBOL(ceph_release_string);`
`107`	`101`