libceph: fix msgpool

There were several problems here:

 1- we weren't tagging allocations with the pool, so they were never
    returned to the pool.
 2- msgpool_put didn't add back to the mempool, even it were called.
 3- msgpool_release didn't clear the pool pointer, so it would have looped
    had #1 not been broken.

These may or may not have been responsible for #1136 or #1381 (BUG due to
non-empty mempool on umount).  I can't seem to trigger the crash now using
the method I was using before.

Signed-off-by: Sage Weil <sage@newdream.net>

1 files changed, 29 insertions, 11 deletions

diff --git a/net/ceph/msgpool.c b/net/ceph/msgpool.c
index d5f2d97ac05c..1f4cb30a42c5 100644
--- a/net/ceph/msgpool.c
+++ b/net/ceph/msgpool.c
@@ -7,27 +7,37 @@
 
 #include <linux/ceph/msgpool.h>
 
-static void *alloc_fn(gfp_t gfp_mask, void *arg)
+static void *msgpool_alloc(gfp_t gfp_mask, void *arg)
 {
         struct ceph_msgpool *pool = arg;
-        void *p;
+        struct ceph_msg *msg;
 
-        p = ceph_msg_new(0, pool->front_len, gfp_mask);
-        if (!p)
-                pr_err("msgpool %s alloc failed\n", pool->name);
-        return p;
+        msg = ceph_msg_new(0, pool->front_len, gfp_mask);
+        if (!msg) {
+                dout("msgpool_alloc %s failed\n", pool->name);
+        } else {
+                dout("msgpool_alloc %s %p\n", pool->name, msg);
+                msg->pool = pool;
+        }
+        return msg;
 }
 
-static void free_fn(void *element, void *arg)
+static void msgpool_free(void *element, void *arg)
 {
-        ceph_msg_put(element);
+        struct ceph_msgpool *pool = arg;
+        struct ceph_msg *msg = element;
+
+        dout("msgpool_release %s %p\n", pool->name, msg);
+        msg->pool = NULL;
+        ceph_msg_put(msg);
 }
 
 int ceph_msgpool_init(struct ceph_msgpool *pool,
                       int front_len, int size, bool blocking, const char *name)
 {
+        dout("msgpool %s init\n", name);
         pool->front_len = front_len;
-        pool->pool = mempool_create(size, alloc_fn, free_fn, pool);
+        pool->pool = mempool_create(size, msgpool_alloc, msgpool_free, pool);
         if (!pool->pool)
                 return -ENOMEM;
         pool->name = name;
@@ -36,14 +46,17 @@ int ceph_msgpool_init(struct ceph_msgpool *pool,
 
 void ceph_msgpool_destroy(struct ceph_msgpool *pool)
 {
+        dout("msgpool %s destroy\n", pool->name);
         mempool_destroy(pool->pool);
 }
 
 struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                                   int front_len)
 {
+        struct ceph_msg *msg;
+
         if (front_len > pool->front_len) {
-                pr_err("msgpool_get pool %s need front %d, pool size is %d\n",
+                dout("msgpool_get %s need front %d, pool size is %d\n",
                        pool->name, front_len, pool->front_len);
                 WARN_ON(1);
 
@@ -51,14 +64,19 @@ struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                 return ceph_msg_new(0, front_len, GFP_NOFS);
         }
 
-        return mempool_alloc(pool->pool, GFP_NOFS);
+        msg = mempool_alloc(pool->pool, GFP_NOFS);
+        dout("msgpool_get %s %p\n", pool->name, msg);
+        return msg;
 }
 
 void ceph_msgpool_put(struct ceph_msgpool *pool, struct ceph_msg *msg)
 {
+        dout("msgpool_put %s %p\n", pool->name, msg);
+
         /* reset msg front_len; user may have changed it */
         msg->front.iov_len = pool->front_len;
         msg->hdr.front_len = cpu_to_le32(pool->front_len);
 
         kref_init(&msg->kref);  /* retake single ref */
+        mempool_free(msg, pool->pool);
 }