1 files changed, 14 insertions, 5 deletions

diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 37b458a9af3a..939eab7aa219 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -754,12 +754,15 @@ static int __get_required_blob_size(struct ceph_inode_info *ci, int name_size,
 
 /*
  * If there are dirty xattrs, reencode xattrs into the prealloc_blob
- * and swap into place.
+ * and swap into place.  It returns the old i_xattrs.blob (or NULL) so
+ * that it can be freed by the caller as the i_ceph_lock is likely to be
+ * held.
  */
-void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci)
 {
         struct rb_node *p;
         struct ceph_inode_xattr *xattr = NULL;
+        struct ceph_buffer *old_blob = NULL;
         void *dest;
 
         dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
@@ -790,12 +793,14 @@ void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
                         dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
 
                 if (ci->i_xattrs.blob)
-                        ceph_buffer_put(ci->i_xattrs.blob);
+                        old_blob = ci->i_xattrs.blob;
                 ci->i_xattrs.blob = ci->i_xattrs.prealloc_blob;
                 ci->i_xattrs.prealloc_blob = NULL;
                 ci->i_xattrs.dirty = false;
                 ci->i_xattrs.version++;
         }
+
+        return old_blob;
 }
 
 static inline int __get_request_mask(struct inode *in) {
@@ -1036,6 +1041,7 @@ int __ceph_setxattr(struct inode *inode, const char *name,
         struct ceph_inode_info *ci = ceph_inode(inode);
         struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
         struct ceph_cap_flush *prealloc_cf = NULL;
+        struct ceph_buffer *old_blob = NULL;
         int issued;
         int err;
         int dirty = 0;
@@ -1109,13 +1115,15 @@ retry:
                 struct ceph_buffer *blob;
 
                 spin_unlock(&ci->i_ceph_lock);
-                dout(" preaallocating new blob size=%d\n", required_blob_size);
+                ceph_buffer_put(old_blob); /* Shouldn't be required */
+                dout(" pre-allocating new blob size=%d\n", required_blob_size);
                 blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
                 if (!blob)
                         goto do_sync_unlocked;
                 spin_lock(&ci->i_ceph_lock);
+                /* prealloc_blob can't be released while holding i_ceph_lock */
                 if (ci->i_xattrs.prealloc_blob)
-                        ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+                        old_blob = ci->i_xattrs.prealloc_blob;
                 ci->i_xattrs.prealloc_blob = blob;
                 goto retry;
         }
@@ -1131,6 +1139,7 @@ retry:
         }
 
         spin_unlock(&ci->i_ceph_lock);
+        ceph_buffer_put(old_blob);
         if (lock_snap_rwsem)
                 up_read(&mdsc->snap_rwsem);
         if (dirty)