ceph: fix theoretically possible double-put on connection

This would only trigger if we bailed out before resetting r_con_filling_msg
because the server reply was corrupt (oversized).

Signed-off-by: Sage Weil <sage@newdream.net>

1 files changed, 1 insertions, 0 deletions

diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index 22a33f8c8807..3d2bfbc232dc 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -1386,6 +1386,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
                      req->r_reply, req->r_con_filling_msg);
                 ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply);
                 ceph_con_put(req->r_con_filling_msg);
+                req->r_con_filling_msg = NULL;
         }
 
         if (front > req->r_reply->front.iov_len) {