Merge tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A patch for a NULL dereference bug introduced in 4.8-rc1 and a handful
  of static checker fixes"

* tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client:
  ceph: initialize pathbase in the !dentry case in encode_caps_cb()
  rbd: nuke the 32-bit pool id check
  rbd: destroy header_oloc in rbd_dev_release()
  ceph: fix null pointer dereference in ceph_flush_snaps()
  libceph: using kfree_rcu() to simplify the code
  libceph: make cancel_generic_request() static
  libceph: fix return value check in alloc_msg_with_page_vector()

6 files changed, 9 insertions, 19 deletions

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 1a04af6d2421..6c6519f6492a 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3950,6 +3950,7 @@ static void rbd_dev_release(struct device *dev)
         bool need_put = !!rbd_dev->opts;
 
         ceph_oid_destroy(&rbd_dev->header_oid);
+        ceph_oloc_destroy(&rbd_dev->header_oloc);
 
         rbd_put_client(rbd_dev->rbd_client);
         rbd_spec_put(rbd_dev->spec);
@@ -5336,15 +5337,6 @@ static ssize_t do_rbd_add(struct bus_type *bus,
         }
         spec->pool_id = (u64)rc;
 
-        /* The ceph file layout needs to fit pool id in 32 bits */
-
-        if (spec->pool_id > (u64)U32_MAX) {
-                rbd_warn(NULL, "pool id too large (%llu > %u)",
-                                (unsigned long long)spec->pool_id, U32_MAX);
-                rc = -EIO;
-                goto err_out_client;
-        }
-
         rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts);
         if (!rbd_dev) {
                 rc = -ENOMEM;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 99115cae1652..16e6ded0b7f2 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1347,9 +1347,12 @@ void ceph_flush_snaps(struct ceph_inode_info *ci,
 {
         struct inode *inode = &ci->vfs_inode;
         struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
-        struct ceph_mds_session *session = *psession;
+        struct ceph_mds_session *session = NULL;
         int mds;
+
         dout("ceph_flush_snaps %p\n", inode);
+        if (psession)
+                session = *psession;
 retry:
         spin_lock(&ci->i_ceph_lock);
         if (!(ci->i_ceph_flags & CEPH_I_FLUSH_SNAPS)) {
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index fa59a85226b2..f72d4ae303b2 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2759,6 +2759,7 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
         } else {
                 path = NULL;
                 pathlen = 0;
+                pathbase = 0;
         }
 
         spin_lock(&ci->i_ceph_lock);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index c83326c5ba58..ef34a02719d7 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -574,7 +574,7 @@ static void complete_generic_request(struct ceph_mon_generic_request *req)
         put_generic_request(req);
 }
 
-void cancel_generic_request(struct ceph_mon_generic_request *req)
+static void cancel_generic_request(struct ceph_mon_generic_request *req)
 {
         struct ceph_mon_client *monc = req->monc;
         struct ceph_mon_generic_request *lookup_req;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index b5ec09612ff7..a97e7b506612 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -4220,7 +4220,7 @@ static struct ceph_msg *alloc_msg_with_page_vector(struct ceph_msg_header *hdr)
 
                 pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),
                                                GFP_NOIO);
-                if (!pages) {
+                if (IS_ERR(pages)) {
                         ceph_msg_put(m);
                         return NULL;
                 }
diff --git a/net/ceph/string_table.c b/net/ceph/string_table.c
index ca53c8319209..22fb96efcf34 100644
--- a/net/ceph/string_table.c
+++ b/net/ceph/string_table.c
@@ -84,12 +84,6 @@ retry:
 }
 EXPORT_SYMBOL(ceph_find_or_create_string);
 
-static void ceph_free_string(struct rcu_head *head)
-{
-        struct ceph_string *cs = container_of(head, struct ceph_string, rcu);
-        kfree(cs);
-}
-
 void ceph_release_string(struct kref *ref)
 {
         struct ceph_string *cs = container_of(ref, struct ceph_string, kref);
@@ -101,7 +95,7 @@ void ceph_release_string(struct kref *ref)
         }
         spin_unlock(&string_tree_lock);
 
-        call_rcu(&cs->rcu, ceph_free_string);
+        kfree_rcu(cs, rcu);
 }
 EXPORT_SYMBOL(ceph_release_string);