Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  rbd: fix safety of rbd_put_client()
  rbd: fix a memory leak in rbd_get_client()
  ceph: create a new session lock to avoid lock inversion
  ceph: fix length validation in parse_reply_info()
  ceph: initialize client debugfs outside of monc->mutex
  ceph: change "ceph.layout" xattr to be "ceph.file.layout"

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3fd31dec8c9c..a6278e7e61a0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -380,6 +380,7 @@ static int rbd_get_client(struct rbd_device *rbd_dev, const char *mon_addr,
         rbdc = __rbd_client_find(opt);
         if (rbdc) {
                 ceph_destroy_options(opt);
+                kfree(rbd_opts);
 
                 /* using an existing client */
                 kref_get(&rbdc->kref);
@@ -406,15 +407,15 @@ done_err:
 
 /*
  * Destroy ceph client
+ *
+ * Caller must hold node_lock.
  */
 static void rbd_client_release(struct kref *kref)
 {
         struct rbd_client *rbdc = container_of(kref, struct rbd_client, kref);
 
         dout("rbd_release_client %p\n", rbdc);
-        spin_lock(&node_lock);
         list_del(&rbdc->node);
-        spin_unlock(&node_lock);
 
         ceph_destroy_client(rbdc->client);
         kfree(rbdc->rbd_opts);
@@ -427,7 +428,9 @@ static void rbd_client_release(struct kref *kref)
  */
 static void rbd_put_client(struct rbd_device *rbd_dev)
 {
+        spin_lock(&node_lock);
         kref_put(&rbd_dev->rbd_client->kref, rbd_client_release);
+        spin_unlock(&node_lock);
         rbd_dev->rbd_client = NULL;
         rbd_dev->client = NULL;
 }