Merge tag 'ceph-for-4.13-rc2' of git://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A number of small fixes for -rc1 Luminous changes plus a readdir race
  fix, marked for stable"

* tag 'ceph-for-4.13-rc2' of git://github.com/ceph/ceph-client:
  libceph: potential NULL dereference in ceph_msg_data_create()
  ceph: fix race in concurrent readdir
  libceph: don't call encode_request_finish() on MOSDBackoff messages
  libceph: use alloc_pg_mapping() in __decode_pg_upmap_items()
  libceph: set -EINVAL in one place in crush_decode()
  libceph: NULL deref on osdmap_apply_incremental() error path
  libceph: fix old style declaration warnings

5 files changed, 33 insertions, 22 deletions

diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index e071d23f6148..ef7240ace576 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -271,6 +271,11 @@ out:
                 if (ret < 0)
                         err = ret;
                 dput(last);
+                /* last_name no longer match cache index */
+                if (fi->readdir_cache_idx >= 0) {
+                        fi->readdir_cache_idx = -1;
+                        fi->dir_release_count = 0;
+                }
         }
         return err;
 }
diff --git a/include/linux/ceph/ceph_features.h b/include/linux/ceph/ceph_features.h
index f0f6c537b64c..040dd105c3e7 100644
--- a/include/linux/ceph/ceph_features.h
+++ b/include/linux/ceph/ceph_features.h
@@ -10,14 +10,14 @@
 #define CEPH_FEATURE_INCARNATION_2 (1ull<<57) // CEPH_FEATURE_SERVER_JEWEL
 
 #define DEFINE_CEPH_FEATURE(bit, incarnation, name)                     \
-        const static uint64_t CEPH_FEATURE_##name = (1ULL<<bit);                \
-        const static uint64_t CEPH_FEATUREMASK_##name =                 \
+        static const uint64_t CEPH_FEATURE_##name = (1ULL<<bit);                \
+        static const uint64_t CEPH_FEATUREMASK_##name =                 \
                 (1ULL<<bit | CEPH_FEATURE_INCARNATION_##incarnation);
 
 /* this bit is ignored but still advertised by release *when* */
 #define DEFINE_CEPH_FEATURE_DEPRECATED(bit, incarnation, name, when) \
-        const static uint64_t DEPRECATED_CEPH_FEATURE_##name = (1ULL<<bit); \
-        const static uint64_t DEPRECATED_CEPH_FEATUREMASK_##name =              \
+        static const uint64_t DEPRECATED_CEPH_FEATURE_##name = (1ULL<<bit); \
+        static const uint64_t DEPRECATED_CEPH_FEATUREMASK_##name =              \
                 (1ULL<<bit | CEPH_FEATURE_INCARNATION_##incarnation);
 
 /*
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 0c31035bbfee..b7cc615d42ef 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3203,8 +3203,10 @@ static struct ceph_msg_data *ceph_msg_data_create(enum ceph_msg_data_type type)
                 return NULL;
 
         data = kmem_cache_zalloc(ceph_msg_data_cache, GFP_NOFS);
-        if (data)
-                data->type = type;
+        if (!data)
+                return NULL;
+
+        data->type = type;
         INIT_LIST_HEAD(&data->links);
 
         return data;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 86a9737d8e3f..901bb8221366 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -5310,7 +5310,10 @@ static int invalidate_authorizer(struct ceph_connection *con)
 
 static void osd_reencode_message(struct ceph_msg *msg)
 {
-        encode_request_finish(msg);
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (type == CEPH_MSG_OSD_OP)
+                encode_request_finish(msg);
 }
 
 static int osd_sign_message(struct ceph_msg *msg)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 864789c5974e..64ae9f89773a 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -338,7 +338,7 @@ static void crush_finalize(struct crush_map *c)
 static struct crush_map *crush_decode(void *pbyval, void *end)
 {
         struct crush_map *c;
-        int err = -EINVAL;
+        int err;
         int i, j;
         void **p = &pbyval;
         void *start = pbyval;
@@ -407,7 +407,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                         size = sizeof(struct crush_bucket_straw2);
                         break;
                 default:
-                        err = -EINVAL;
                         goto bad;
                 }
                 BUG_ON(size == 0);
@@ -439,31 +438,31 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                         err = crush_decode_uniform_bucket(p, end,
                                   (struct crush_bucket_uniform *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_LIST:
                         err = crush_decode_list_bucket(p, end,
                                (struct crush_bucket_list *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_TREE:
                         err = crush_decode_tree_bucket(p, end,
                                 (struct crush_bucket_tree *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_STRAW:
                         err = crush_decode_straw_bucket(p, end,
                                 (struct crush_bucket_straw *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_STRAW2:
                         err = crush_decode_straw2_bucket(p, end,
                                 (struct crush_bucket_straw2 *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 }
         }
@@ -474,7 +473,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 u32 yes;
                 struct crush_rule *r;
 
-                err = -EINVAL;
                 ceph_decode_32_safe(p, end, yes, bad);
                 if (!yes) {
                         dout("crush_decode NO rule %d off %x %p to %p\n",
@@ -489,7 +487,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 /* len */
                 ceph_decode_32_safe(p, end, yes, bad);
 #if BITS_PER_LONG == 32
-                err = -EINVAL;
                 if (yes > (ULONG_MAX - sizeof(*r))
                           / sizeof(struct crush_rule_step))
                         goto bad;
@@ -557,7 +554,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         if (*p != end) {
                 err = decode_choose_args(p, end, c);
                 if (err)
-                        goto bad;
+                        goto fail;
         }
 
 done:
@@ -567,10 +564,14 @@ done:
 
 badmem:
         err = -ENOMEM;
-bad:
+fail:
         dout("crush_decode fail %d\n", err);
         crush_destroy(c);
         return ERR_PTR(err);
+
+bad:
+        err = -EINVAL;
+        goto fail;
 }
 
 int ceph_pg_compare(const struct ceph_pg *lhs, const struct ceph_pg *rhs)
@@ -1399,7 +1400,7 @@ static struct ceph_pg_mapping *__decode_pg_upmap_items(void **p, void *end,